That passkey
Security Advisory
That “passkey setup” call from IT? It may be an attack.
Attackers are phoning and texting staff, posing as the IT helpdesk, to talk them into handing over their Microsoft 365 accounts. Passkeys are a good thing. Criminals are now using the word to get in.
What to do this weekHow the attack worksWhat Microsoft found
Microsoft Threat Intelligence has reported a social engineering campaign that uses the theme of passkey, MFA and single sign-on enrolment to compromise cloud identities. It is not a software flaw. It targets people.
A familiar voice
The attacker contacts staff by phone or SMS and claims to be IT. The reason sounds routine: “we are rolling out passkeys” or “your SSO needs to be synchronised”.
A convincing website
Staff are sent to look-alike sign-in pages on freshly registered domains, with names built around words like passkey, helpdesk and SSO.
A quiet takeover
Once inside, the attacker adds their own MFA method, maps the organisation, then downloads SharePoint, OneDrive and email content at scale.
How the attack unfolds
Each step looks small on its own. Together they move from one phone call to a full data breach.
- The call. Someone claiming to be the helpdesk contacts a staff member by phone or text about a passkey, MFA or SSO “enrolment”.
- The fake portal. The staff member is sent to a look-alike domain that imitates the company sign-in page.
- The capture. Adversary-in-the-middle phishing or a device-code sign-in flow captures the credentials and the session, even when MFA is used.
- The access. The attacker signs in to identity portals and business applications as the real user.
- The foothold. A new authenticator app or phone number is registered, so access survives a password reset.
- The survey. Microsoft Graph is used to list users, groups, roles and sensitive resources across the tenant.
- The theft. Large volumes of SharePoint, OneDrive and email data are pulled out through APIs, kept below roughly 1,000 files an hour to avoid alerts.
- The leverage. The stolen data is used for extortion. Microsoft links the activity to the groups it tracks as Storm-3121 and Storm-3032.
Why this matters to your business
If your team uses Microsoft 365, this is aimed at you.
What is really at risk
- Client files, contracts, financials and staff records held in SharePoint and OneDrive
- Email history, including attachments and anything sent in confidence
- Your reputation, and your obligations under the NZ Privacy Act 2020 if personal information is taken
- Extortion pressure, because the attacker already holds your data
The uncomfortable part: the person who was called did what felt right. They followed what sounded like an official IT process. That is why training alone is not enough, and why technical controls matter.
What to do this week
These actions follow Microsoft’s published recommendations.
- Tell your people. Your IT team will never ask staff to enrol a passkey or MFA method after an unexpected call or text. If in doubt, hang up and ring IT on a number you already know.
- Move to phishing-resistant MFA. Use FIDO2 security keys or passkeys, which are bound to the real sign-in site and are far harder to capture with a fake page.
- Require managed devices. Set Conditional Access so Microsoft 365 can only be reached from devices your business controls.
- Block device-code sign-in. Switch the flow off except where a business need is documented.
- Watch for the warning signs. An unusual sign-in followed by a new MFA method, broad Microsoft Graph activity, or a sudden spike in file and email access.
- Be ready to respond. Know how to revoke active sessions and remove unauthorised MFA methods quickly. Minutes matter.
Source: Microsoft Security Blog, “Passkey-themed social engineering leads to identity cloud compromise”, 9 September 2026. Read the full article.
Not sure where you stand?
Imagetext can review your Microsoft 365 sign-in settings, Conditional Access and MFA methods, and tell you plainly where the gaps are.
Book a security review Call +64 9 623 3102
#CyberSecurity #Microsoft365 #PhishingAlert #Passkeys #ITSecurity