Hackers Pose as IT Support to Hijack Microsoft 365 Accounts With Fake Passkey Alerts
Microsoft warns of vishing campaigns by Storm-3121 and Storm-3032 hijacking Microsoft 365 accounts via fake passkey alerts, adding attacker-controlled MFA and exfiltrating cloud data.
Microsoft Security Research has tracked the campaign since May 2026: callers posing as IT helpdesk staff tell employees to urgently update passkeys, MFA, or SSO settings via domains such as add-passkey[.]com and contoso[.]add-passkey[.]com. The lures lead to adversary-in-the-middle phishing or device-code authentication flows that yield credentials, session tokens, or OAuth tokens, after which attackers enroll their own MFA methods for persistence and run Microsoft Graph reconnaissance. They then collect SharePoint, OneDrive, and sometimes Exchange Online data at deliberately low rates (often under 1,000 files or messages per hour), with python-httpx seen in high-volume file access. Microsoft attributes initial access tradecraft to Storm-3121 and Storm-3032, linked respectively to ShinyHunters/Falcon and BlackFile/Helix extortion operations.
- Callers posing as IT support push victims to passkey lure domains like add-passkey[.]com.
- Lures enable AiTM token theft or device-code phishing granting valid OAuth tokens bypassing MFA.
- Attackers register new MFA methods, then perform Graph API reconnaissance and low-volume cloud data collection.
- Microsoft attributes tradecraft to Storm-3121 (ShinyHunters/Falcon-linked) and Storm-3032 (BlackFile/Helix actors).
- Response guidance: revoke unauthorized MFA methods, kill sessions, correlate Graph telemetry with SaaS access.
- ATT&CK
- T1656 ImpersonationT1557 Adversary-in-the-MiddleT1528 Steal Application Access TokenT1098 Account ManipulationT1530 Data from Cloud Storage
- Vendors
- Microsoft
- Threat actors
- Storm-3121Storm-3032ShinyHuntersBlackFileHelix
- Organizations
- Microsoft
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | add-passkey.com | helpdesk[.]com, secure-passkey[.]com, setupmypasskey[.]com, add-passkey[.]com, integratedsso[.]com, and oktasession[.]com. The operator |
| domain | contoso.add-passkey.com | e operators commonly use organization-specific URLs such as contoso[.]add-passkey[.]com, which makes the fraudulent destination appear more cre |
| domain | integratedsso.com | ure-passkey[.]com, setupmypasskey[.]com, add-passkey[.]com, integratedsso[.]com, and oktasession[.]com. The operators commonly use organi |
| domain | keysyncos.com | ins SSO oktasession[.]com Domains Identity-provider session keysyncos[.]com Domains Key synchronization Note: IP addresses and domain |
| domain | oktasession.com | ypasskey[.]com, add-passkey[.]com, integratedsso[.]com, and oktasession[.]com. The operators commonly use organization-specific URLs su |
| domain | passkeyhelpdesk.com | subdomain. Examples of observed lure infrastructure include passkeyhelpdesk[.]com, secure-passkey[.]com, setupmypasskey[.]com, add-passkey[ |
| domain | secure-passkey.com | observed lure infrastructure include passkeyhelpdesk[.]com, secure-passkey[.]com, setupmypasskey[.]com, add-passkey[.]com, integratedsso[. |
| domain | setupmypasskey.com | ucture include passkeyhelpdesk[.]com, secure-passkey[.]com, setupmypasskey[.]com, add-passkey[.]com, integratedsso[.]com, and oktasession[ |
From the original article
3 min read at gbhackers.com
Threat actors are impersonating corporate IT helpdesk staff in an active social-engineering campaign that hijacks Microsoft 365 identities, establishes MFA persistence, and systematically collects data from SharePoint, OneDrive, and Exchange Online. Microsoft Security Research said it has observed the cloud-focused intrusions since May 2026.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.