Attackers Use Passkey-Themed Phishing to Breach Cloud Environments

Researchers at Microsoft report a coordinated social engineering campaign where attackers impersonate IT helpdesk staff and use passkey/MFA-themed pretexts to trick users into visiting phishing sites or approving device-code flows; the goal is to intercept device codes and session tokens (AiTM and device-code attacks) to obtain persistent access to accounts and cloud environments. Attacks are highly personalized, phone-based, leave little forensic evidence, and are attributed to actors tied to extortion groups.