Since May 2026, multiple extortion-linked threat actors have used passkey and single sign-on themed social engineering attacks to compromise Microsoft 365 corporate accounts. The attack chain begins with extensive reconnaissance followed by impersonation of IT help desks to convince employees to update passkey or MFA settings via phishing sites mimicking Microsoft login pages. The attackers employ adversary-in-the-middle phishing and device-code authentication flows to capture credentials and session tokens. Post-compromise, attackers use Microsoft Graph API to enumerate organizational resources and access sensitive files and emails across Microsoft 365 services. They maintain persistence by adding MFA methods under their control, enabling ongoing access without victim cooperation. Data exfiltration is automated but paced to avoid detection, lasting hours to days. Microsoft attributes these activities to multiple threat actors within an extortion ecosystem, including groups tracked as Storm-3121 and Storm-3032, overlapping with Google's UNC6671 cluster.

Successful attacks result in unauthorized access to corporate Microsoft 365 accounts, enabling attackers to conduct reconnaissance, access sensitive organizational data, and exfiltrate files and emails from SharePoint Online, OneDrive for Business, and Exchange Online. Attackers can maintain persistent access by registering MFA methods they control, bypassing future MFA challenges. The data theft is systematic and prolonged, potentially exposing significant volumes of confidential corporate information. The compromised accounts also provide access to connected single sign-on applications beyond Microsoft 365, increasing the scope of impact.

Microsoft recommends monitoring for unusual sign-ins followed by new MFA registrations, suspicious Microsoft Graph API reconnaissance activity, and anomalous access patterns to SharePoint, OneDrive, and Exchange Online. If compromise is suspected, administrators should revoke active sessions and tokens, reset credentials, and remove any unauthorized authentication methods or mailbox rules. Because this attack relies on social engineering and phishing, user awareness training and verification of IT help desk communications are critical. No official patch applies as this is a social engineering attack targeting user behavior rather than a software vulnerability.