Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data

As cited

Copy frozen at 2026-09-14 02:21 UTC (site build).

threat intel

Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data

Microsoft disclosed two campaigns in which threat actors sent over one million fraudulent emails between August 3 and 5, 2026, by impersonating chief executive officers and using passkey-themed social engineering to compromise cloud environments. Attackers leveraged third-party email delivery infrastructure to distribute the financial fraud scams and gain unauthorized access to victim accounts.

Why it matters: Organizations with Microsoft cloud environments face credential compromise via passkey phishing; practitioners should review email authentication controls, monitor for suspicious cloud access patterns, and brief users on social engineering tactics impersonating executives.

Source published

2026-09-13 10:11 UTC

First seen by Cybersecurity Tracker

2026-09-14 01:50 UTC