Social engineering lures pivot from MFA fatigue to passkey pretexts
The passkey-themed phishing wave is a registration drive in disguise, attackers don't want your passkey, they want your session token.
TL;DR
Microsoft Security Research reports active cloud intrusions since May 2026 that open with social engineering calls and SMS messages themed around passkey, MFA, or SSO enrollment. Attackers direct targets to adversary-in-the-middle phishing pages or device-code authentication flows, capturing credentials and session tokens. Once inside, they add their own authentication methods, enumerate SharePoint and OneDrive via Microsoft Graph, and collect mail through REST APIs. The initial compromise often leaves little endpoint telemetry because victims open links on personal mobile devices not onboarded to Defender for Endpoint.
The playbook Microsoft describes is methodical and nearly telemetry-invisible at the front door. An employee gets a call or SMS on their personal phone from someone claiming to be IT support. The pretext is urgent: a passkey, MFA configuration, or SSO setup needs immediate attention or services will break. The victim is directed to a phishing site that mimics a legitimate Microsoft sign-in.
The passkey framing is the headline, but the mechanics underneath are older and simpler. In many cases the attacker is running a standard adversary-in-the-middle proxy, capturing the session token rather than a passkey credential. In others, it's a device-code flow where the victim unwittingly authorizes the attacker's device. Either way, the outcome is the same: the attacker holds a valid, authenticated session. If the phishing link is opened on a personal phone outside Defender for Endpoint coverage, the whole initial-access phase can vanish from enterprise telemetry. Investigators often have only the employee's memory of the call to work from.
Once authenticated, the pattern is consistent: the attacker adds authentication methods to the account, runs high-volume Microsoft Graph queries to map SharePoint and OneDrive content, and collects mail through REST APIs. Microsoft's researchers assess the data access and collection as consistent with automation and proxy-associated infrastructure. The domains and IPs rotate, but the sequence (compromise, persistence, reconnaissance, collection) is durable enough to hunt on.
Defenders should investigate across identity logs, Microsoft Graph activity, SharePoint, OneDrive, and Exchange signals, then revoke sessions and remove unauthorized authentication methods for confirmed compromises. The post also notes that in some cases attackers pivot from a compromised internal account to send the same passkey-theme lures through Microsoft Teams, using the trust of a known colleague to widen the net.
Published ·Deep Fathom