Passkey-themed phishing attacks lead to Microsoft 365 data theft

Microsoft reports that extortion-linked threat actors (including clusters tracked as Storm-3121/Storm-3032 and overlapping with UNC6671) have used passkey- and SSO-themed phone/SMS social engineering, adversary-in-the-middle (AiTM) and device-code phishing since May 2026 to compromise corporate Microsoft 365 accounts, perform Microsoft Graph reconnaissance, add attacker-controlled authentication methods for persistence, and systematically exfiltrate files from SharePoint, OneDrive and Exchange while registering convincing phishing domains and using automated access patterns to blend in with legitimate traffic.