Hackers Use Passkey-Themed Phishing to Hijack Microsoft 365 Accounts and Steal Cloud Data
Microsoft reports passkey-themed phishing campaigns hijacking Microsoft 365 accounts via AiTM and device-code flows, then exfiltrating cloud data.
Microsoft researchers identified passkey-themed phishing across cloud intrusions observed since May 2026, where callers posing as IT support direct victims to lookalike sign-in pages. The flows include adversary-in-the-middle phishing and device-code authentication, letting attackers capture usable sessions even when MFA succeeds, followed by rogue MFA registration for persistence. Attackers enumerate tenants via Microsoft Graph and collect SharePoint, OneDrive, and Exchange data at rates below 1,000 items per hour; lure domains include passkeyhelpdesk.com and setupmypasskey.com.
- The passkey narrative is a pretext for AiTM phishing or device-code sign-ins that capture sessions despite MFA.
- Attackers add their own authenticator apps, phone numbers, or OTP tokens for durable persistence.
- Graph enumeration and high-volume cloud downloads use python-httpx and rotate infrastructure to blend in.
- Recommended: phishing-resistant MFA, session and token revocation, and review of newly registered authentication methods.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | add-passkey.com | y security Domain setupmypasskey[.]com Passkey setup Domain add-passkey[.]com Passkey enrollment Domain integratedsso[.]com SSO Domain |
| domain | integratedsso.com | ey setup Domain add-passkey[.]com Passkey enrollment Domain integratedsso[.]com SSO Domain oktasession[.]com Identity-provider session Do |
| domain | keysyncos.com | O Domain oktasession[.]com Identity-provider session Domain keysyncos[.]com Key synchronization Domain oskeysync[.]com Key synchroniz |
| domain | myconnectkey.com | istration Domain syncmykey[.]com Key synchronization Domain myconnectkey[.]com Key connection Domain oskeyconnect[.]com Key connection D |
| domain | oktasession.com | om Passkey enrollment Domain integratedsso[.]com SSO Domain oktasession[.]com Identity-provider session Domain keysyncos[.]com Key sync |
| domain | oskeyconnect.com | hronization Domain myconnectkey[.]com Key connection Domain oskeyconnect[.]com Key connection Domain validationsetupac[.]com Account val |
| domain | oskeyregister.com | ey synchronization Domain oskeysetup[.]com Key setup Domain oskeyregister[.]com Key registration Domain syncmykey[.]com Key synchronizati |
| domain | oskeysetup.com | onization Domain oskeysync[.]com Key synchronization Domain oskeysetup[.]com Key setup Domain oskeyregister[.]com Key registration Dom |
| domain | oskeysync.com | r session Domain keysyncos[.]com Key synchronization Domain oskeysync[.]com Key synchronization Domain oskeysetup[.]com Key setup Dom |
| domain | passkeyhelpdesk.com | m becoming a data breach. Type Indicator Description Domain passkeyhelpdesk[.]com Passkey support lure Domain secure-passkey[.]com Passkey |
| domain | portalsetuphub.com | validationsetupac[.]com Account validation and setup Domain portalsetuphub[.]com Portal setup Note: IP addresses and domains are intention |
| domain | secure-passkey.com | on Domain passkeyhelpdesk[.]com Passkey support lure Domain secure-passkey[.]com Passkey security Domain setupmypasskey[.]com Passkey setu |
| domain | setupmypasskey.com | rt lure Domain secure-passkey[.]com Passkey security Domain setupmypasskey[.]com Passkey setup Domain add-passkey[.]com Passkey enrollment |
| domain | syncmykey.com | ey setup Domain oskeyregister[.]com Key registration Domain syncmykey[.]com Key synchronization Domain myconnectkey[.]com Key connect |
| domain | validationsetupac.com | connection Domain oskeyconnect[.]com Key connection Domain validationsetupac[.]com Account validation and setup Domain portalsetuphub[.]com |
From the original article
4 min read at cybersecuritynews.com
Hackers are using passkey-themed phishing to take control of Microsoft 365 accounts and collect cloud data. It can defeat MFA protections. The campaign starts with calls and texts to employees.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.