Passkey-themed social engineering leads to identity and cloud compromise
Microsoft tracks ongoing cloud intrusions where passkey-themed helpdesk lures enable AiTM credential theft, MFA persistence, and SharePoint data theft.
Microsoft Security Research is tracking active cloud-based intrusions, observed since May 2026, that begin with helpdesk impersonation calls and SMS lures urging urgent passkey, MFA, or SSO updates. The lures lead to adversary-in-the-middle phishing or device-code authentication flows that capture credentials and session tokens or grant actor access, after which the actors add authentication methods, conduct Microsoft Graph reconnaissance, and download SharePoint and OneDrive content via REST APIs. Phishing domains embed victim organization names as subdomains (e.g., contoso.add-passkey[.]com), are often registered with Nicenic, and go operational within hours. Microsoft advises revoking sessions and removing unauthorized authentication methods for confirmed compromises.
- Calls and SMS pose as IT helpdesk urging passkey, MFA, or SSO updates
- AiTM flows capture credentials and tokens; device-code flows grant access
- Actors add authentication methods, enumerate Graph, and pull cloud data
- Phishing domains use org-name subdomains, registered rapidly via Nicenic
- Defenders should revoke sessions and remove unauthorized authentication methods
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | add-passkey.com | lpdesk[.]com, secure-passkey[.]com†, setupmypasskey[.]com†, add-passkey[.]com† SSO and identity provider integratedsso[.]com†, oktasess |
| domain | companyname.maliciousdomain.com | uman trust. The actor creates domains following the pattern companyname[.]maliciousdomain[.]com to impersonate organization-specific authentication por |
| domain | contoso.add-passkey.com | can persuade users to proceed with authentication. Example: contoso[.]add-passkey[.]com . The me Domain examples, defanged Passkey passkeyhelpd |
| domain | integratedsso.com | trar involvement in the activity. For example, company-name.integratedsso[.]com and company-name.secure-passkey[.]com illustrate how the |
| domain | keysyncos.com | sso[.]com†, oktasession[.]com Key setup and synchronization keysyncos[.]com, oskeysync[.]com, oskeysetup[.]com, oskeyregister[.]com, |
| domain | myconnectkey.com | om, oskeysetup[.]com, oskeyregister[.]com, syncmykey[.]com, myconnectkey[.]com, oskeyconnect[.]com Setup and verification validationsetu |
| domain | oktasession.com | skey[.]com† SSO and identity provider integratedsso[.]com†, oktasession[.]com Key setup and synchronization keysyncos[.]com, oskeysync[ |
| domain | oskeyconnect.com | , oskeyregister[.]com, syncmykey[.]com, myconnectkey[.]com, oskeyconnect[.]com Setup and verification validationsetupac[.]com, portalset |
| domain | oskeyregister.com | ization keysyncos[.]com, oskeysync[.]com, oskeysetup[.]com, oskeyregister[.]com, syncmykey[.]com, myconnectkey[.]com, oskeyconnect[.]com |
| domain | oskeysetup.com | setup and synchronization keysyncos[.]com, oskeysync[.]com, oskeysetup[.]com, oskeyregister[.]com, syncmykey[.]com, myconnectkey[.]com |
| domain | oskeysync.com | ession[.]com Key setup and synchronization keysyncos[.]com, oskeysync[.]com, oskeysetup[.]com, oskeyregister[.]com, syncmykey[.]com, |
| domain | passkeyhelpdesk.com | dd-passkey[.]com . The me Domain examples, defanged Passkey passkeyhelpdesk[.]com, secure-passkey[.]com†, setupmypasskey[.]com†, add-passke |
| domain | portalsetuphub.com | nnect[.]com Setup and verification validationsetupac[.]com, portalsetuphub[.]com Step 3-4 : User identity compromise From one sign-in to b |
| domain | secure-passkey.com | example, company-name.integratedsso[.]com and company-name.secure-passkey[.]com illustrate how the same company name can appear under dif |
| domain | setupmypasskey.com | anged Passkey passkeyhelpdesk[.]com, secure-passkey[.]com†, setupmypasskey[.]com†, add-passkey[.]com† SSO and identity provider integrated |
| domain | syncmykey.com | om, oskeysync[.]com, oskeysetup[.]com, oskeyregister[.]com, syncmykey[.]com, myconnectkey[.]com, oskeyconnect[.]com Setup and verific |
| domain | validationsetupac.com | connectkey[.]com, oskeyconnect[.]com Setup and verification validationsetupac[.]com, portalsetuphub[.]com Step 3-4 : User identity compromise |
From the original article
11 min read at microsoft.com
Passkey-themed social engineering is being used to compromise identities and enable broader cloud attacks. Learn how threat actors establish MFA persistence, abuse Microsoft Graph for reconnaissance, and access SharePoint, OneDrive, and email data, along with key detection and mitigation guidance.
microsoft.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.