Hackers Are Using Passkey Updates as a New Microsoft Phishing Hook

Microsoft tracked campaigns since May 2026 in which threat actors impersonate IT staff and use AiTM and device-code phishing to trick employees into approving logins or providing codes, allowing attackers to obtain session tokens, add authentication methods for persistence, and access SharePoint, OneDrive, and Exchange; activity is linked to groups such as Storm-3121 and Storm-3032 and highlights the need for stricter enrollment controls, session monitoring, and rapid token revocation.