Passkey-themed social engineering leads to identity and cloud compromise
ID: e715ad3e-2d61-5ad1-a914-425175ce4f84
STIX ID: report--e715ad3e-2d61-5ad1-a914-425175ce4f84
Feed Name: Microsoft Security
Date Published: 2026-09-09
Date Updated: 2026-09-10
Author: Microsoft Security Research, Krithika Ramakrishnan, Bharat Vaghela, Vaibhav Deshmukh, Subhajit Ghosh, Anusha Chakraborty, Akash Chaudhuri, Victor Chingtham and Ivan Macalintal
Microsoft Security Research describes an ongoing cloud intrusion campaign (observed since May 2026) that uses voice/SMS social engineering with passkey/SSO lures, AiTM and device-code phishing to capture sessions, enroll attacker-controlled MFA methods for persistence, then perform automated Microsoft Graph reconnaissance and high-volume SharePoint/OneDrive/Exchange content collection consistent with data exfiltration; the report provides IOC examples, KQL detection/hunting queries, mitigation guidance, and attribution to criminal groups like Storm-3121 and Storm-3032.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.