This campaign involves social engineering attacks themed around passkeys, where threat actors impersonate IT helpdesk staff to trick victims into visiting phishing sites that replicate Microsoft sign-in portals. Using adversary-in-the-middle and device code authentication techniques, attackers steal credentials and establish persistence by adding unauthorized MFA methods. They leverage Microsoft Graph API to map organizational users, groups, permissions, and resources. The attackers then automate data collection from cloud services such as SharePoint, OneDrive, and Exchange, exfiltrating data over extended periods at controlled rates to avoid triggering security alerts. The adversaries identified include Storm-3121 and Storm-3032. Multiple malicious domains associated with the campaign have been identified as indicators of compromise.

The campaign results in unauthorized access to cloud accounts, persistent compromise through added MFA methods, extensive reconnaissance of organizational resources, and significant data exfiltration from key Microsoft cloud services. This can lead to loss of sensitive information and potential further exploitation of compromised environments.

No official patch or fix applies as this is a social engineering campaign rather than a software vulnerability. Organizations should educate users about this specific passkey-themed phishing tactic, verify IT helpdesk communications through trusted channels, and monitor for unauthorized MFA enrollments. Blocking or monitoring access to the identified malicious domains can help reduce exposure. Implementing strong anomaly detection for unusual data access patterns and leveraging conditional access policies may also mitigate impact.