Passkey Phishing Hijacks Microsoft 365 Accounts for Cloud Data Theft

The activity, observed since May 2026, relies heavily on social engineering. Victims may receive a phone call, SMS message, or Microsoft Teams message from someone impersonating the organization’s IT helpdesk.

The attacker claims that the user must urgently update a passkey, multifactor authentication (MFA), or SSO setting to avoid losing access.

The victim is then directed to a fake Microsoft sign-in page. In many cases, the passkey message is only a lure.

The real goal is to capture credentials and session tokens through adversary-in-the-middle (AiTM) phishing, or to trick the victim into approving a device-code authentication request on a legitimate Microsoft page.

This can give the attacker access without directly stealing a browser cookie.paste.txt

Passkey Phishing Hijacks Microsoft 365

After gaining access, the attackers move quickly to make the compromise persistent. They register an authentication method under their control, such as a new phone number, Microsoft Authenticator device, or software-based one-time password token.

This added MFA method allows the threat actor to satisfy later authentication prompts without involving the victim.

Microsoft noted that attackers may use stolen tokens and unrevoked sessions alongside these newly added authentication methods to maintain access.

One investigated sequence began with an unusual sign-in to Microsoft OfficeHome from an unmanaged device.

After MFA was completed, the same session accessed My Apps, My Profile, My Sign-Ins, Microsoft Approval Management, SharePoint Online, OneDrive, Outlook Web, and internal business applications.

The threat actor used the access to identify available applications, users, groups, roles, authentication methods, cloud repositories, emails, and attachments.

Attackers have also used trusted internal accounts to send passkey-themed messages through Microsoft Teams, increasing the chance that employees will trust the request.

Their phishing domains often include the target company’s name as a subdomain, such as contoso.add-passkey.com, making malicious URLs appear more credible at a quick glance.

Once persistence is in place, the attackers abuse Microsoft Graph APIs to map the victim’s Microsoft 365 environment.

They enumerate directory users and groups, identify privileged roles, inspect enterprise applications and OAuth permissions, and locate SharePoint sites, OneDrive folders, messages, and attachments.

Microsoft warned that a single Graph API request may look normal. The danger becomes clear when the same account systematically performs identity discovery, privilege checks, file searches, mailbox enumeration, and content retrieval in one session or across a short period.

The final stage is cloud data collection. Microsoft observed high-volume SharePoint and OneDrive file access and downloads, along with Exchange Online email collection through REST APIs.

Some activity used the python-httpx user agent, suggesting automation, although Microsoft cautioned that the user agent alone is not proof of malicious behavior.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC