Passkey Social Engineering Drives Cloud Account Compromise

Introduction

Microsoft has published new research on an active attack pattern that targets cloud identities through passkey-themed social engineering. For IT and security teams, the key takeaway is that these intrusions are not just credential theft events—they often lead to persistent access, Microsoft Graph reconnaissance, and data collection from SharePoint, OneDrive, and Exchange.

What’s happening

Attackers are using phone calls, SMS messages, and sometimes Microsoft Teams messages to impersonate IT helpdesk staff. Victims are told they must urgently update a passkey, MFA, or SSO setting.

Common tactics observed

• Passkey-themed lures used as a pretext for phishing rather than true passkey enrollment
• Adversary-in-the-middle (AiTM) phishing to capture credentials and session tokens
• Device code phishing where users unknowingly authorize attacker-controlled access
• Unauthorized authentication method changes to establish persistence after sign-in
• High-volume Microsoft Graph activity for reconnaissance and content discovery
• SharePoint and OneDrive downloads consistent with targeted data collection
• Email collection through REST APIs as part of broader cloud compromise

Microsoft notes that attackers often create convincing domains that include the target organization’s name as a subdomain, making the phishing infrastructure look legitimate at a glance.

Why this matters for administrators

This campaign is notable because the initial compromise may leave limited endpoint evidence, especially if the user interacts from a personal mobile device outside managed security tooling. In many cases, the first clue may be a user reporting a suspicious phone call or text.

Security teams should watch for a sequence of events rather than a single indicator:

• Unusual sign-ins from unmanaged or unfamiliar devices
• Device code authentication events that do not fit normal user behavior
• New or unexpected MFA or authentication methods added to accounts
• Microsoft Graph activity spikes after sign-in
• Unusual access to SharePoint, OneDrive, Exchange, My Sign-Ins, or My Apps

Recommended next steps

• Educate users that IT should not ask them to approve urgent passkey or MFA changes through unsolicited calls or texts
• Review sign-in logs for anomalous OfficeHome, My Apps, and identity portal access
• Investigate device code flow usage and token replay indicators
• Audit recently added authentication methods and remove unauthorized entries
• Revoke active sessions for confirmed or suspected compromised identities
• Correlate identity, Graph, SharePoint, OneDrive, and Exchange telemetry during investigations

Bottom line

Microsoft’s research highlights how social engineering can quickly escalate into full cloud account compromise and data exposure. Defenders should focus on detecting the full attack chain—from suspicious sign-ins and MFA persistence to Graph-based reconnaissance and content access—so they can contain incidents before data is exfiltrated.