Attackers use passkey-themed scams to hijack Microsoft 365 accounts
Microsoft tracks ongoing M365 cloud intrusions since May using passkey-themed helpdesk vishing, AiTM phishing, and device-code abuse.
Microsoft Security Research has tracked active cloud intrusions since May in which attackers posing as IT helpdesk staff lured employees with fake passkey/MFA enrollment requests. Attacks used adversary-in-the-middle phishing pages, device-code authentication flows, and Teams messages from compromised accounts. Attackers registered their own MFA methods, enumerated tenants via Microsoft Graph, and accessed SharePoint, OneDrive, and Exchange Online data, throttling activity below 1000 files/emails per hour.
- Passkey is the lure; phishable MFA was bypassed, not the passkey standard
- Victims recruited via calls to personal mobile numbers impersonating IT helpdesk
- Attackers persist by registering phone, authenticator, and software OTP MFA methods
- Automation observed via python-httpx user agent in high-volume SharePoint/OneDrive activity
- Microsoft recommends phishing-resistant MFA, Conditional Access, and blocking device-code flows
- ATT&CK
- T1566.004 Spearphishing VoiceT1557 Adversary-in-the-MiddleT1621 Multi-Factor Authentication Request GenerationT1556.006 Multi-Factor Authentication Device RegistrationT1087 Account Discovery
From the original article
2 min read at csoonline.com
Attackers are using passkey-themed social engineering to trick employees into giving them access to their Microsoft accounts.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.