Passkey-Themed Social Engineering Targets Cloud Identities
Attackers are impersonating IT helpdesks to trick users into compromising their cloud identities through sophisticated social engineering tactics, leading to widespread data access.
Microsoft Security Research is actively tracking a concerning trend where threat actors are leveraging passkey-themed social engineering to compromise cloud identities. This campaign, observed since May 2026, involves attackers impersonating IT helpdesk personnel to lure victims into phishing sites or device-code authentication flows. The ultimate goal is to capture credentials and session tokens, enabling subsequent reconnaissance, data collection, and exfiltration from cloud environments.
The attack chain typically begins with a phone call or message to a user's personal number, with the impersonator claiming to be from the organization's IT department. They create a sense of urgency, often citing the need for an immediate update to passkey, multifactor authentication (MFA), or single sign-on (SSO) configurations. This pretext directs the victim to a website designed to mimic legitimate Microsoft sign-in pages, often delivered via SMS. While passkey enrollment is frequently mentioned, it serves as a deceptive narrative to guide users into adversary-in-the-middle (AiTM) phishing or device-code authentication attacks, where credentials and session tokens are stolen or access is granted unknowingly.
Attackers are meticulously preparing for these intrusions by conducting extensive pre-attack research, gathering information about target organizations and their employees from publicly available sources like social networking and professional profiling platforms. This allows for personalized targeting and increases the effectiveness of their lures. In some instances, compromised accounts are leveraged to send similar passkey-themed messages via internal platforms like Microsoft Teams, further enhancing the legitimacy of the request.
The infrastructure supporting these operations is rapidly deployed and frequently changes. Threat actors register generic domains and embed the target organization's name as a subdomain, creating URLs that appear familiar and trustworthy. For example, domains might follow patterns like company-name.integratedsso[.]com or company-name.secure-passkey[.]com. These domains are often registered with registrars like Nicenic and become operational within hours, significantly limiting the window for defenders to identify and block them before they are encountered by employees.
Once initial access is gained, the attackers move to reconnaissance within the targeted organization. They may use compromised accounts to expand their reach or proceed with exploring the compromised environment. The observed activity includes high-volume Microsoft Graph API calls, downloads from SharePoint and OneDrive, and the collection of emails via REST APIs. This indicates a systematic approach to gathering sensitive information and preparing for potential data exfiltration.
Defenders are advised to investigate this attack sequence by examining signals across identity systems, Microsoft Graph, SharePoint, OneDrive, and Exchange. Key indicators include anomalous sign-ins, the addition of new authentication methods by threat actors, and unusual API activity. For confirmed compromises, it is crucial to revoke active sessions and remove any unauthorized authentication methods that have been added by the attackers.
This campaign highlights a sophisticated blend of technical deception and social engineering, exploiting user trust and the increasing adoption of modern authentication methods like passkeys. The rapid deployment of phishing infrastructure and the use of personalized lures make it challenging for organizations to defend against. The focus on cloud identity compromise underscores the critical need for robust security awareness training and vigilant monitoring of cloud environments.