Microsoft: passkey-themed help desk phishing hits Microsoft 365 accounts

Microsoft has published research on social engineering campaigns that use passkey, MFA and single sign-on themes as bait to take over corporate Microsoft accounts. According to the original report, the activity has been observed since May 2026 and is attributed to several actors in the same extortion ecosystem, tracked as Storm-3121 and Storm-3032 and linked to groups including ShinyHunters, Falcon and Helix. The end goal is not passkey enrolment but bulk theft of documents and email from Microsoft 365.

What happened

The attackers research a target organisation and its staff from public sources, then call or message employees while posing as the internal IT help desk. The pretext is urgency: a passkey, MFA or SSO setting supposedly has to be updated or access will be lost. Victims are sent — sometimes by SMS to a personal phone — to pages that imitate Microsoft sign-in, or are talked into entering a supplied code into Microsoft's genuine device-code authentication form.

Both paths produce a valid session for the attacker. Adversary-in-the-middle pages capture credentials and session tokens; device-code phishing issues a token to an attacker-controlled OAuth application without a further MFA prompt. Phishing domains combine the victim company name with words like passkey, SSO or key sync, often placing the company name in a subdomain.

After access, Microsoft observed reconnaissance through Microsoft Graph — enumerating users, groups, directory roles, registered authentication methods, applications, SharePoint sites and mailboxes — followed by sustained download activity in SharePoint Online, OneDrive for Business and, in some cases, Exchange Online via REST API. The collection looks automated (a python-httpx user agent was seen) but deliberately slow, staying under roughly 1,000 files or emails per hour and running for hours or days. Persistence is typically established by registering an extra MFA method the attacker controls; Microsoft notes this does not survive a full credential and session reset.

Why it matters

This campaign works against organisations that already deployed MFA. The weak point is the human process around identity changes, plus authentication flows that most companies never think about, such as device code. A single compromised account with broad SharePoint access is enough for a data-theft extortion case, and SSO means the same token can open Google Workspace, Salesforce, Slack, Atlassian and similar services.

Smaller teams are attractive targets precisely because the help desk is informal — often one person, reachable by phone, used to solving things quickly. The Graph calls used for reconnaissance are the same ones legitimate tooling makes, so detection depends on sequence and volume rather than on any single suspicious request.

What to do

• Disable device-code authentication in Entra ID via Conditional Access unless a specific workflow needs it, and document which one does.
• Agree a rule that IT never asks staff to change MFA or passkey settings during an unsolicited call, and give employees a verification channel to check such requests.
• Move to phishing-resistant methods (FIDO2 keys, platform passkeys) for administrators and anyone with wide SharePoint access, and restrict sensitive resources to managed devices.
• Alert on new MFA method registration shortly after an unfamiliar sign-in, and on high-volume FileAccessed/FileDownloaded events. Make sure your incident checklist includes revoking sessions and tokens, not just resetting the password.