Hackers Pose as IT Support to Hijack Microsoft 365 Accounts With Fake Passkey Alerts

Threat actors are impersonating corporate IT helpdesk staff in an active social-engineering campaign that hijacks Microsoft 365 identities, establishes MFA persistence, and systematically collects data from SharePoint, OneDrive, and Exchange Online.

Microsoft Security Research said it has observed the cloud-focused intrusions since May 2026.

The activity is marked by unusual sign-ins, attacker-added authentication methods, extensive Microsoft Graph API reconnaissance, and high-volume cloud-data access from proxy-associated infrastructure

The campaign begins with a phone call or SMS sent to an employee’s personal device.

Posing as IT support, the caller claims the target must urgently update a passkey, multifactor authentication configuration, or single sign-on setting to avoid losing access.

Victims are then directed to a fake Microsoft-branded authentication portal, often hosted on domains that embed the targeted organization’s name as a subdomain.

Examples of observed lure infrastructure include passkeyhelpdesk[.]com, secure-passkey[.]com, setupmypasskey[.]com, add-passkey[.]com, integratedsso[.]com, and oktasession[.]com.

The operators commonly use organization-specific URLs such as contoso[.]add-passkey[.]com, which makes the fraudulent destination appear more credible during a rushed helpdesk-style interaction.

Despite the passkey narrative, the attackers are not always attempting to enroll a legitimate passkey.

Microsoft said the lure is frequently used to push victims into adversary-in-the-middle phishing or device-code authentication flows.

In an AiTM scenario, the phishing infrastructure captures credentials and authenticated session tokens.

In device-code phishing, the victim is convinced to enter a code at a real Microsoft authentication page, unknowingly granting an attacker-controlled client access to their Microsoft 365 resources.

This distinction matters because device-code abuse can provide the attacker with a valid OAuth token without stealing a browser cookie.

The token can then be replayed to access permitted cloud services and effectively bypass the MFA challenge that the victim has already approved.

Microsoft 365 Accounts Hijacked

Microsoft noted that personal-device usage can complicate investigations because phishing activity may not appear in endpoint telemetry when the device is unmanaged.

After gaining access, the operator quickly converts a temporary session into durable account control.

Microsoft observed that, attackers registering new authentication methods, including phone numbers, authenticator applications, and software-based OTP tokens.

An actor-controlled MFA factor enables future logins without the victim’s participation, particularly when active sessions or valid credentials remain available.

The next phase is tenant reconnaissance through Microsoft Graph. The compromised identity may enumerate users, groups, directory roles, authentication methods, applications, service principals, OAuth permission grants, SharePoint sites, OneDrive drives, mailbox folders, emails, and attachments.

Any individual Graph API request may look legitimate, but a rapid sequence touching identity, privilege, application, repository, and mailbox resources is a strong behavioral indicator of an intrusion.

Microsoft observed the attackers rotating IP addresses across authentication, reconnaissance, and data-collection stages.

They then accessed SharePoint Online and OneDrive for Business documents at scale, while some cases included Exchange Online email collection through REST APIs.

The collection was deliberately paced often below 1,000 files or messages per hour to blend into normal enterprise activity while sustaining access for hours or days.

Python-httpx appeared in several high-volume file-access events, though Microsoft cautioned that the user agent alone is not proof of malicious behavior.

Microsoft attributes the initial-access tradecraft to multiple operators, including Storm-3121 and Storm-3032.

Storm-3121 has been linked to access activity preceding ShinyHunters and Falcon extortion operations, while Storm-3032 is associated with actors that splintered from BlackFile and operate under the Helix extortion banner.

Organizations should treat an unusual sign-in, a new authentication-method enrollment, Graph reconnaissance, and abnormal SaaS downloads as a single incident chain not isolated alerts.

Microsoft recommends immediately validating and removing unauthorized authentication methods, revoking active sessions, and investigating token issuance and sign-in activity for the affected identity.

Security teams should also correlate Graph API telemetry with SharePoint, OneDrive, Exchange REST, mailbox, and attachment-access events.

Particular attention should go to broad API traversal, paging activity, directory-role discovery, OAuth-consent enumeration, anonymous-proxy access, and sudden high-volume document retrieval.

Employees should be trained to independently verify any helpdesk request involving passkeys, MFA, SSO, or authentication codes.

A legitimate IT team should not pressure staff to authenticate through an unsolicited SMS link, enter a device code provided over the phone, or approve an authentication prompt they did not initiate.

IOCs

Indicators	Type	Description
passkeyhelpdesk[.]com	Domains	Passkey support lure
secure-passkey[.]com	Domains	Passkey security
setupmypasskey[.]com	Domains	Passkey setup
add-passkey[.]com	Domains	Passkey enrollment
integratedsso[.]com	Domains	SSO
oktasession[.]com	Domains	Identity-provider session
keysyncos[.]com	Domains	Key synchronization

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.