Microsoft Tracks Passkey-Themed Social Engineering Behind Cloud Data Theft

Microsoft has identified a social-engineering campaign in which attackers pose as IT support staff and use false passkey or multifactor-authentication setup requests to compromise cloud accounts.

The company has observed the activity across multiple organizations since May. Targets receive calls or text messages that create urgency around a supposed security requirement, then are directed to a fraudulent sign-in page or persuaded to complete a device-code authorization flow.

Microsoft stressed that the campaign generally does not break passkey cryptography or interfere with a genuine passkey enrollment. Instead, attackers use the terminology as a pretext to capture credentials and session tokens through adversary-in-the-middle phishing, or to convince a user to authorize a device controlled by the attacker.

Once inside an account, the intruders commonly register another authentication method, enroll a device or add a software-based one-time password. That persistence can allow continued access even after the initial password is changed.

The attackers then use Microsoft Graph and other cloud interfaces to map the environment and collect information from email, SharePoint and OneDrive. Microsoft has also observed automated data extraction intended to support extortion.

The activity includes two tracked groups. Storm-3121 has been associated with theft that can lead to extortion by ShinyHunters and Falcon, while Storm-3032 is associated with the Helix extortion operation.

The findings arrive as Microsoft prepares mandatory passkey registration for Entra ID, its cloud identity and access-management service. Passkeys replace shared secrets with cryptographic credentials tied to a device or credential provider, making conventional password phishing less effective when the sign-in process is correctly implemented.

Other research has shown that attackers can still target the systems and people surrounding passwordless authentication. Unit 42 recently demonstrated account and device attack paths around Google Password Manager passkeys, while Proofpoint documented attackers spoofing OAuth application identifiers to probe Entra accounts.

Microsoft recommends that organizations verify help-desk communications through trusted channels, restrict device-code authentication where it is not required, monitor new authentication-method registrations and apply phishing-resistant credentials through controlled enrollment processes. It also advises security teams to investigate unusual Graph activity, bulk cloud-data access and newly registered credentials together, since each can mark a stage of the same intrusion.

Sources: Microsoft Security Blog

–

By the ID Tech Editorial Team