Microsoft

Microsoft published details on September 13, 2026 of two active campaigns, and one of them cuts against the assumption that passkeys end phishing. Since May 2026, attackers have been calling and texting employees on their personal phone numbers, claiming to be the organization's IT help desk, and telling them their passkey, MFA or SSO configuration must be updated immediately or they will lose access. The employee follows a link to a counterfeit page that mimics the Microsoft sign-in experience, and the operator drives them through an adversary-in-the-middle or device code authentication flow. The result is either captured credentials or a token the user granted on the attacker's behalf. Inside the same intrusions Microsoft saw the actors register their own authentication method, then pull mailbox, SharePoint and OneDrive content over Microsoft Graph and REST APIs at machine speed.

The second campaign is louder and simpler. Between August 3 and 5, 2026, operators sent over one million scam emails through third-party email delivery infrastructure, impersonating the CEO of each target company and asking accounts payable to push an ACH transfer for a fabricated ServiceNow annual subscription. Microsoft assesses that generative AI was used to build the templates and tailor individual messages. Targeting was primarily U.S. enterprise, concentrated in IT services, consumer goods, real estate and discrete manufacturing.

The passkey pretext, step by step

Microsoft describes heavy pre-attack research, with employee names, roles and reporting lines harvested from social networking and professional profiling sites. That research is what makes the call land: the caller knows the target's manager, their department and the name of the internal help desk. The chain is short and has no malware in it.

• Voice call or SMS to the employee's personal number, claiming to be internal IT, with an access-disruption deadline.
• A link to a counterfeit Microsoft sign-in page, delivered to the personal device so it never crosses a corporate mail gateway or proxy.
• An adversary-in-the-middle proxy relays the real sign-in, or the caller reads out a device code and asks the user to enter it, which grants a token without the attacker ever holding a credential.
• The actor adds their own authentication method to the account, which survives a password reset.
• In a smaller number of cases, an already compromised account sends the same passkey-themed message over Microsoft Teams, which arrives inside the trust boundary.

What the first hour after sign-in looks like

Microsoft characterizes the post-access behavior as automated collection from compromised cloud identities using proxy-associated infrastructure. That word automated matters for response timelines: this is not an operator browsing a mailbox, it is tooling enumerating and downloading. In at least one investigated case the actors performed an anomalous sign-in to Microsoft Office Home from an unmanaged device to widen access.

• Suspicious sign-in, followed closely by the addition of a new authentication method on the same account.
• High-volume Microsoft Graph activity that does not match the user's normal application pattern.
• Bulk SharePoint and OneDrive downloads.
• Mailbox collection through REST APIs rather than a mail client.

Infrastructure with a blockable shape

The actors register generic root domains themed on passkeys, SSO enrollment, account activation and identity verification, then append a victim-specific subdomain in the form company-name.malicious-domain.com. That pattern is the useful part for defenders: a credential panel that puts your own company name to the left of a domain you have never seen is high-signal in DNS and proxy logs, even when the root domain is brand new. Microsoft named these, along with two domains from the ACH run.

passkeyhelpdesk[.]com
secure-passkey[.]com
setupmypasskey[.]com
add-passkey[.]com
integratedsso[.]com
oktasession[.]com
syncmykey[.]com
portalsetuphub[.]com
service-nowinc[.]com
domainlify[.]net

Attribution, and why it is messy

Microsoft attributes the initial access to a range of actors including Storm-3121 and Storm-3032. Storm-3121 activity leads to ShinyHunters and Falcon, also tracked as CL-CRI-1182, extortion. Storm-3032 is Microsoft's designation for UNC6671, a set of actors that split off from the BlackFile group, tracked as CL-CRI-1116, and now operate the Helix extortion brand. The same tradecraft overlaps with a loose-knit collective tracked elsewhere as Cordial Spider, O-UNC-045 and PREY-0058. Prior reporting on UNC6671 described exactly this technique: credential harvesting panels on generic passkey-themed root domains with victim-specific subdomains, feeding targeted voice phishing. The overlaps are probably not one team. They are more likely splintered affiliates reusing the same initial access playbooks, the same commoditized phishing panels, the same voice phishing callers and the same hosting. For a defender, that means the panel and the phone call are commodity services, so a takedown of one brand changes very little about what your users will receive next month.

The million-email ACH run

The financial fraud campaign is worth reading as a template quality problem, not a volume problem. Microsoft's point is that traditional invoice scams rely on a single lure, while this one layered executive impersonation, vendor branding, a fabricated invoice and a forged supporting email thread into one narrative built to lower skepticism. The operators looked up the actual CEO, CFO and president at each target and dropped their real names and email addresses into the signature block, and included a purported approval of the fake invoice so the accounts payable reader saw the internal sign-off they were trained to look for.

• Impersonation domains registered ahead of the send, including service-nowinc[.]com.
• Delivery through trusted third-party email infrastructure, which buys reputation and complicates sender-based blocking.
• Generative AI used for template creation and per-recipient tailoring, which is why volume and personalization no longer trade off against each other.

What this changes for your identity program

Two things follow. Phishing resistance is a property of the whole enrollment lifecycle, not of the credential, so if a user can bootstrap a new passkey from an unmanaged device after an SMS link, the strength of the resulting credential is not the control that matters. And the compromise signal has moved from the sign-in to what happens immediately after it. A single sign-in from an unusual location is noisy and often benign. A sign-in followed within minutes by a new authentication method and a spike in Graph requests to mail and sites endpoints is not. Alert on the pair.

pwsh -c "Connect-MgGraph -Scopes AuditLog.Read.All,Policy.Read.All -NoWelcome; Get-MgAuditLogSignIn -Filter \"authenticationProtocol eq 'deviceCode'\" -Top 500 | Select-Object CreatedDateTime,UserPrincipalName,IpAddress,AppDisplayName,ClientAppUsed | Format-Table -Auto"

pwsh -c "Connect-MgGraph -Scopes AuditLog.Read.All -NoWelcome; Get-MgAuditLogDirectoryAudit -Filter \"activityDisplayName eq 'User registered security info'\" -Top 500 | Select-Object ActivityDateTime,@{n='Actor';e={\$_.InitiatedBy.User.UserPrincipalName}},@{n='Target';e={\$_.TargetResources[0].UserPrincipalName}},Result | Format-Table -Auto"

grep -RiE 'passkeyhelpdesk|secure-passkey|setupmypasskey|add-passkey|integratedsso|oktasession|syncmykey|portalsetuphub|service-nowinc|domainlify' /var/log 2>/dev/null | head -50

pwsh -c "Connect-MgGraph -Scopes Policy.ReadWrite.ConditionalAccess,Application.Read.All -NoWelcome; New-MgIdentityConditionalAccessPolicy -BodyParameter @{displayName='Report-only: block device code flow';state='enabledForReportingButNotEnforced';conditions=@{clientAppTypes=@('all');applications=@{includeApplications=@('All')};users=@{includeUsers=@('All')};authenticationFlows=@{transferMethods='deviceCodeFlow'}};grantControls=@{operator='OR';builtInControls=@('block')}}"

pwsh -c "Connect-MgGraph -Scopes User.RevokeSessions.All -NoWelcome; Revoke-MgUserSignInSession -UserId [email protected]"

pwsh -c "Connect-MgGraph -Scopes UserAuthenticationMethod.Read.All -NoWelcome; Get-MgUserAuthenticationMethod -UserId [email protected] | Select-Object Id,AdditionalProperties | Format-List"