Microsoft has issued a critical warning regarding a sophisticated wave of social engineering attacks targeting corporate Microsoft 365 accounts. These attacks, observed since May 2026, are being orchestrated by threat actors associated with notorious extortion gangs such as ShinyHunters and Helix. The campaign begins with meticulous pre-attack research, where adversaries scrape professional networking sites to map organizational structures before contacting employees via phone or SMS.

The core of the deception revolves around the concept of 'Passkeys' and Single Sign-On (SSO) configurations. Attackers create a sense of urgency, claiming that employees must update their security settings immediately to avoid losing access to corporate systems. Victims are then lured to phishing portals that meticulously mimic legitimate Microsoft login pages. To increase authenticity, attackers often use subdomains that incorporate the victim's company name, such as company-name.secure-passkey[.]com.

Why This Matters

BozokMedia analysis shows that the attackers are weaponizing the industry's migration toward passwordless authentication. By using the terminology of 'Passkeys'—a security feature designed to stop phishing—the attackers create a psychological blind spot. This allows them to bypass traditional security training that focuses on password theft, moving instead toward session token theft.

"The use of device-code phishing is particularly dangerous because it leverages legitimate Microsoft authentication pages, making the attack nearly invisible to the average user."

Technically, the attackers employ two primary methods: Adversary-in-the-Middle (AiTM) and Device-Code Phishing. AiTM attacks allow the capture of session tokens, effectively bypassing MFA. Device-code phishing tricks the user into authorizing an attacker-controlled OAuth application via a legitimate Microsoft portal. Once the token is issued, the attacker gains unrestricted access to the user's entire cloud ecosystem.

Once inside, the breach extends far beyond a single email account. Attackers systematically map the cloud environment using Microsoft Graph, enumerating licenses, directory roles, and privileged accounts. They gain access to sensitive files in SharePoint Online and internal business applications. Because many companies use Microsoft for SSO, the breach cascades into third-party services including Salesforce, Google Workspace, Dropbox, and Atlassian.

To ensure long-term access, the threat actors establish persistence by registering their own MFA methods—such as new phone numbers or authenticator apps—onto the compromised account. This ensures that even if the user changes their password, the attacker retains access unless a full session and credential reset is performed by an administrator.

Frequently Asked Questions

Q1: Are passkeys themselves insecure?
No, passkeys are highly secure. The vulnerability here is human psychology (social engineering), not the underlying cryptographic technology.

Q2: How can organizations prevent these attacks?
Implement strict phishing-resistant MFA, conduct targeted employee training on social engineering, and monitor Entra logs for suspicious sign-ins from unmanaged devices.