Microsoft tracks passkey lures into Microsoft 365 cloud theft

Microsoft Security Research published a 9 September 2026 threat blog on passkey-themed social engineering that leads to identity and Microsoft 365 cloud compromise. The team has tracked the pattern since May 2026: unusual sign-ins, attacker-added authentication methods, high-volume Microsoft Graph activity, SharePoint and OneDrive downloads, and email collection through REST APIs. The writeup is a threat blog, not a CVE or a CISA catalog listing.

Initial access often starts with a call or SMS on the employee's personal phone from someone claiming to be IT helpdesk, pushing an urgent passkey, MFA, or SSO update. The passkey story is often a pretext. The real path is adversary-in-the-middle phishing or a device-code flow that captures credentials and session tokens, or authorizes an attacker-controlled client.

Because the first contact lands on a personal phone, Help Net Security notes there is little endpoint telemetry. In several reviewed cases, the earliest evidence was the employee remembering the call or text.

After access, the actors enroll their own MFA (phone, authenticator, or software OTP) so they can stay in after the first stolen session dies. They then use Microsoft Graph to enumerate users, groups, roles, apps, SharePoint, OneDrive, and mail. Collection is measured: fewer than 1,000 files or emails accessed in any one-hour period, over hours to days.

Microsoft Threat Intelligence attributes the initial access to a range of actors, including Storm-3121 (which feeds ShinyHunters and Falcon extortion) and Storm-3032 (a BlackFile splinter now under the Helix banner). The pattern sits next to Azure data advertised against Fortune 500 names, another cloud-theft lane in the same identity plane.

Microsoft's own defenses include phishing-resistant MFA (FIDO2 passkeys, Windows Hello), Conditional Access that requires managed devices, blocking the device-code flow except where needed, and enabling Graph activity logs. On compromise, the company describes revoking sessions and removing unauthorized authentication methods.

Some offers on this page may be paid placements or contain affiliate links.