Microsoft 365 data theft via passkey phishing attacks

Microsoft has warned that passkey-themed phishing and social engineering attacks are being used to compromise corporate Microsoft 365 accounts and steal data from cloud services. The activity has been observed since May 2026 and involves threat actors linked to ShinyHunters, Helix, and other extortion gangs, according to Microsoft. A passkey is a passwordless sign-in method that usually relies on a device, biometric, or hardware key instead of a typed password; single sign-on (SSO) lets a user log in once and then reach several connected applications. The attackers use these familiar security concepts as lures, but they are not actually trying to enroll a passkey. Instead, they redirect employees to fake login pages or to a legitimate Microsoft device-code flow that hands access to the attacker.

The scheme begins with extensive pre-attack research. Microsoft says the actors gather information about employees and organizational structure from public sources such as social networking and professional profiling platforms. They then call or message targeted workers while pretending to be corporate IT help desks, telling people they must urgently update a passkey, multi-factor authentication (MFA, a second proof of identity beyond a password), or SSO configuration to avoid losing access to corporate systems. Victims are directed to phishing sites designed to look like real Microsoft login pages, and links are sometimes sent by SMS to employees' personal phones. The attackers register domains that combine company names with words like passkey, SSO, key synchronization, account setup, and identity verification. Microsoft lists examples including passkeyhelpdesk[.]com, secure-passkey[.]com, setupmypasskey[.]com, add-passkey[.]com, integratedsso[.]com, oktasession[.]com, keysyncos[.]com, and oskeysync[.]com. To make the portal more convincing, the attackers often place the victim company's name in a subdomain, such as company-name.secure-passkey[.]com.

Microsoft attributes this initial access activity to multiple threat actors operating in the same extortion ecosystem, including groups it tracks as Storm-3121 and Storm-3032. Storm-3121 is associated with ShinyHunters and Falcon extortion, while Storm-3032 is believed to be tied to BlackFile extortion group members who now work under the Helix name. The same activity overlaps with attacks previously documented by Google Threat Intelligence under the UNC6671 threat cluster. Google has reported that UNC6671 uses phone-based social engineering and passkey-themed phishing infrastructure to compromise corporate identities before accessing enterprise cloud environments, and it has linked that activity to the same extortion gangs, including BlackFile, Helix, Falcon, Pink, and Redact.

Two related techniques carry the actual compromise. In an adversary-in-the-middle (AiTM) attack, a phishing site sits between the user and the real Microsoft login, capturing both the credentials and the session token that proves the user has authenticated. In device-code phishing, the victim is persuaded to enter a supplied code into Microsoft's legitimate authentication page. That action issues an authentication token to an attacker-controlled OAuth application, a program that acts on the user's behalf, so the attacker can reach the account without completing another MFA challenge. Microsoft says this gives the attacker access to all of the user's resources and connected SSO applications, including Microsoft 365, Salesforce, Google Workspace, Dropbox, Adobe, SAP, Slack, Zendesk, Atlassian, and many others.

Microsoft's new research provides a closer look at what happens inside Microsoft cloud environments after an account is compromised. In one investigated attack, Microsoft observed a suspicious sign-in from an unmanaged device to a Microsoft 365 service identified in Entra logs, Microsoft's identity and access management records, as 'OfficeHome'. That identifier is associated with the Office 365 portal's shared infrastructure and browser-based Office applications. After completing MFA, the attacker established a valid session and began checking what the compromised account could reach. Within minutes the session accessed My Apps to see which applications were assigned to the account, My Profile for organizational information, Microsoft Approval Management, account-management interfaces, and My Sign-Ins. The attacker then moved to SharePoint Online, Outlook Web, Microsoft 365 collaboration and search services, an internal business application, and authentication flows tied to virtual desktops. Microsoft says the session remained active for around one hour while the attacker listed sensitive files and internal applications.

In another attack, the passkey social engineering led to device-code phishing, and the attacker received a token that allowed access to all user resources. In a third case, the threat actor used previously compromised credentials for an account where Microsoft believes an authenticator application had been registered days earlier. The attackers then performed reconnaissance with an automated Node.js system and Microsoft Graph, the programming interface that reads and manages data across Microsoft 365.

After initial access, attackers often add a multi-factor authentication method they control, such as a new phone number, an authenticator application, or software-based one-time password tokens, to the compromised identity. This lets them satisfy future MFA challenges without the victim's help, though Microsoft notes that this persistence does not survive a complete credential and session reset. The attackers then use Microsoft Graph to enumerate the victim's cloud environment. Microsoft saw Graph requests that listed organizations, licenses, enabled services, users, groups, group membership, directory roles, privileged accounts, registered authentication methods, applications, service principals, OAuth permissions, application role assignments, SharePoint sites, document libraries, folders, files, OneDrive resources, and mail folders, messages, and attachments. Microsoft says requests such as /users, /groups, or /sites are common in enterprise environments and may not raise alarms by themselves, but the activity becomes suspicious when the same account, application, or token rapidly moves across different resources, checks privileges and authentication settings, and then starts accessing email, attachments, files, or documents.

After reconnaissance, the attackers move into cloud data collection from Microsoft 365. Microsoft observed high-volume access and download activity targeting SharePoint Online and OneDrive for Business, with some intrusions extending into Microsoft Exchange Online through REST API-based access to email content, where a REST API is a common way for programs to talk to a service over the internet. Across SharePoint and OneDrive, the activity generated significant volumes of FileAccessed and FileDownloaded ev