Passkey-themed phishing attacks lead to Microsoft 365 data theft
Microsoft links ShinyHunters- and Helix-affiliated actors to passkey-themed vishing and device-code phishing that compromises Microsoft 365 accounts and steals cloud data.
78
Threat actor
Storm-3032
- Mentions · 7d0
- Mentions · 30d0
- All mentions3
- First seenSep 10, 2026
- Last mentionedSep 11, 2026
Timeline
3 articles · newest firstAttackers call employees’ personal phones to break into Microsoft 365 accounts
Microsoft tracks vishing campaigns by Storm-3121 and Storm-3032 that impersonate IT staff, phish Microsoft 365 credentials, and steal cloud data.
74
Hackers Pose as IT Support to Hijack Microsoft 365 Accounts With Fake Passkey Alerts
Microsoft warns of vishing campaigns by Storm-3121 and Storm-3032 hijacking Microsoft 365 accounts via fake passkey alerts, adding attacker-controlled MFA and exfiltrating cloud data.
72
Appears with
- Helixthreat actor · 3
- Microsoftvendor · 3
- ShinyHuntersthreat actor · 3
- Storm-3121threat actor · 3
- Microsoft 365product · 3
- BlackFilethreat actor · 3
- SharePointproduct · 2
- OneDriveproduct · 2
- Exchange Onlineproduct · 2
- Microsoft Graphproduct · 2
- Falconthreat actor · 2
- Salesforceproduct · 1
- UNC6671threat actor · 1
- Google Threat Intelligenceorganization · 1
- Slackproduct · 1
- Dropboxproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.