Attackers Use Passkey Lures to Hijack Microsoft 365 Accounts

Microsoft Security Research has identified an active campaign in which threat actors use passkey-themed social engineering to hijack Microsoft 365 accounts. Since May, attackers have been impersonating IT helpdesk staff to trick employees into providing access to their cloud identities.

The attacks typically begin with a phone call or a message sent to an employee’s personal mobile number. The attacker, claiming to be from the organisation’s IT department, tells the victim that a passkey, multi-factor authentication (MFA) setting, or single sign-on (SSO) configuration must be updated immediately to avoid service disruption.

Social Engineering and Phishing Methods

Once engaged, victims are redirected to fraudulent websites designed to resemble Microsoft sign-in pages. In adversary-in-the-middle (AiTM) attacks, the adversary captures credentials and session tokens. In device-code attacks, the victim is prompted to enter a code on a legitimate Microsoft authentication page, which authorises an attacker-controlled client.

Jon Baker, VP of Threat-Informed Defense at AttackIQ, noted that the passkey itself is not the technical weakness, but rather a psychological lure used to target phishable MFA methods. “The passkey in this campaign is the lure, not the weakness,” Baker said. “The MFA that got bypassed was phishable. Real passkeys would have stopped it.”

The initial interaction often leaves minimal evidence on endpoints, particularly if the victim uses a personal device that is not managed by enterprise security software. In some instances, attackers have used previously compromised accounts to send these passkey-themed requests through Microsoft Teams, making them appear to originate from a trusted colleague.

Establishing Persistence and Data Access

After successfully compromising an identity, attackers work to establish long-term persistence by registering their own authentication methods. Microsoft observed threat actors adding new phone numbers, authenticator applications, and software-based one-time password (OTP) tokens under their own control. This allows them to satisfy future MFA challenges without the legitimate user.

Once persistence is established, attackers use Microsoft Graph to map the victim’s environment, enumerating users, groups, roles, and cloud resources. This reconnaissance is followed by access to SharePoint, OneDrive, and Exchange Online to locate and exfiltrate files and emails.

To evade detection, attackers have maintained a controlled pace, sometimes accessing fewer than 1,000 files or emails per hour to blend in with normal enterprise behaviour. Some activity has also shown signs of automation, such as the use of the “python-httpx” user agent during high-volume SharePoint and OneDrive operations.

Microsoft recommends that organisations correlate unusual sign-in activity with the registration of new authentication methods. To mitigate these risks, the company advises enforcing phishing-resistant MFA via Conditional Access and blocking device-code and authentication-transfer flows where there is no legitimate business requirement.