Passkey-themed social engineering leads to identity and cloud compromise

As cited

Copy frozen at 2026-09-10 00:44 UTC (site build).

identity access

Passkey-themed social engineering leads to identity and cloud compromise

Microsoft is tracking active cloud intrusions since May 2026 in which attackers use passkey-themed social engineering to compromise identities, then register unauthorized multifactor authentication (MFA) methods for persistence and conduct extensive reconnaissance via Microsoft Graph to enumerate users, groups, permissions, and resources. Following reconnaissance, attackers systematically download files from SharePoint and OneDrive, access mailboxes through REST APIs, and exfiltrate data at a measured pace over hours to days. The activity chain involves phone-based lures impersonating IT helpdesk support, adversary-in-the-middle phishing, device code flows, and automated collection infrastructure, with threat actors rotating IP addresses across authentication, reconnaissance, and exfiltration phases.

Why it matters: Organizations using Microsoft 365 face immediate risk from identity compromise via social engineering and passkey lures targeting employees on personal devices; defenders must correlate unusual sign-ins, new MFA devices, broad Graph reconnaissance, and high-volume file or email downloads as a connected attack sequence and implement phishing-resistant MFA (FIDO2, Windows Hello for Business) and Conditional Access policies to block device code flows and require managed devices for sensitive workloads.

Source published

2026-09-09 17:41 UTC

First seen by Cybersecurity Tracker

2026-09-10 00:16 UTC