Passkey-themed social engineering leads to identity and cloud compromise
Source AlienVault OTX General
Description
Multiple cloud accounts have been compromised through passkey-themed social engineering campaigns since May 2026. Attackers impersonate IT helpdesk staff via phone calls or SMS, directing victims to phishing sites that mimic Microsoft sign-in pages. After obtaining credentials through adversary-in-the-middle or device code authentication flows, attackers establish persistence by adding unauthorized MFA methods. They then conduct extensive reconnaissance using Microsoft Graph API to map users, groups, permissions, and resources. The intrusion culminates in high-volume data collection from SharePoint, OneDrive, and Exchange using automated tools, with exfiltration occurring over hours or days at controlled rates to avoid detection.
Impact
The campaign results in unauthorized access to cloud accounts, persistent compromise through added MFA methods, extensive reconnaissance of organizational resources, and significant data exfiltration from key Microsoft cloud services. This can lead to loss of sensitive information and potential further exploitation of compromised environments.
Defensive guidance
No official patch or fix applies as this is a social engineering campaign rather than a software vulnerability. Organizations should educate users about this specific passkey-themed phishing tactic, verify IT helpdesk communications through trusted channels, and monitor for unauthorized MFA enrollments. Blocking or monitoring access to the identified malicious domains can help reduce exposure. Implementing strong anomaly detection for unusual data access patterns and leveraging conditional access policies may also mitigate impact.
MITRE ATT&CK techniques
- T1078.004Valid Accounts: Cloud Accounts · Stealth, Persistence, Privilege Escalation, Initial Access (opens in a new tab)
- T1591Gather Victim Org Information · Reconnaissance (opens in a new tab)
- T1598.003Phishing for Information: Spearphishing Link · Reconnaissance (opens in a new tab)
- T1583.001Acquire Infrastructure: Domains · Resource Development (opens in a new tab)
- T1585.002Establish Accounts: Email Accounts · Resource Development (opens in a new tab)
Indicators of compromise
Domains 19
- setupmypasskey.com
- validationsetupac.com
- portalsetuphub.com
- myconnectkey.com
- oskeysync.com
- keysyncos.com
- oskeyregister.com
- passkeyhelpdesk.com
- oskeysetup.com
- add-passkey.com