PhishingPublished 11 Sep 2026

Passkey-themed phishing attacks lead to Microsoft 365 data theft

Source Bleeping Computer

phishing

Description

Threat actors linked to extortion groups such as ShinyHunters and Helix are conducting passkey-themed phishing attacks targeting corporate Microsoft 365 accounts. These attacks use social engineering to impersonate IT help desks and trick employees into signing into adversary-in-the-middle phishing sites or authorizing device-code authentication flows. Once compromised, attackers perform reconnaissance and systematically exfiltrate data from Microsoft 365 services including SharePoint Online, OneDrive for Business, and Exchange Online. The attackers maintain persistence by registering MFA methods they control and avoid rapid data theft to evade detection.

Impact

Successful attacks result in unauthorized access to corporate Microsoft 365 accounts, enabling attackers to conduct reconnaissance, access sensitive organizational data, and exfiltrate files and emails from SharePoint Online, OneDrive for Business, and Exchange Online. Attackers can maintain persistent access by registering MFA methods they control, bypassing future MFA challenges. The data theft is systematic and prolonged, potentially exposing significant volumes of confidential corporate information. The compromised accounts also provide access to connected single sign-on applications beyond Microsoft 365, increasing the scope of impact.

Defensive guidance

Microsoft recommends monitoring for unusual sign-ins followed by new MFA registrations, suspicious Microsoft Graph API reconnaissance activity, and anomalous access patterns to SharePoint, OneDrive, and Exchange Online. If compromise is suspected, administrators should revoke active sessions and tokens, reset credentials, and remove any unauthorized authentication methods or mailbox rules. Because this attack relies on social engineering and phishing, user awareness training and verification of IT help desk communications are critical.

Summary

Since May 2026, multiple extortion-linked threat actors have used passkey and single sign-on themed social engineering attacks to compromise Microsoft 365 corporate accounts. The attack chain begins with extensive reconnaissance followed by impersonation of IT help desks to convince employees to update passkey or MFA settings via phishing sites mimicking Microsoft login pages. The attackers employ adversary-in-the-middle phishing and device-code authentication flows to capture credentials and session tokens. Post-compromise, attackers use Microsoft Graph API to enumerate organizational resources and access sensitive files and emails across Microsoft 365 services. They maintain persistence by adding MFA methods under their control, enabling ongoing access without victim cooperation. Data exfiltration is automated but paced to avoid detection, lasting hours to days. Microsoft attributes these activities to multiple threat actors within an extortion ecosystem, including groups tracked as Storm-3121 and Storm-3032, overlapping with Google's UNC6671 cluster.

References

bleepingcomputer.com/news/security/passkey-themed-phishing-attacks-lead-to-microsoft-365-data-theft/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 11 Sep 2026, 17:32 UTC

References

Community reviews

Related threats