Passkey-themed vishing and device-code phishing compromise Microsoft 365: Storm-3121/Storm-3032 linked to extortion gangs, N0va phishkit emerges, and 29,785 Direct Send spoofed…

Microsoft attributes a May 2026-onward campaign of IT-helpdesk vishing with passkey/MFA/SSO lures to Storm-3121 (ShinyHunters/Falcon-linked) and Storm-3032 (BlackFile/Helix), who use AiTM and device-code phishing to steal M365 credentials and tokens, register…

Microsoft Security Research is tracking active cloud intrusions, observed since May 2026, in which attackers call or text employees' personal phones while posing as IT helpdesk staff, urging urgent passkey, MFA, or SSO updates. The lures lead to adversary-in-the-middle phishing pages that capture credentials and session tokens, or device-code authentication flows that issue OAuth tokens to attacker-controlled apps, exposing SSO-connected services including Salesforce, Slack, and Dropbox. Lure domains observed include add-passkey[.]com and contoso.add-passkey[.]com (victim organization names embedded as subdomains), plus passkeyhelpdesk.com and setupmypasskey.com; they are often registered via Nicenic and go operational within hours. Post-compromise, actors enroll their own phone, authenticator, and software OTP MFA methods for persistence that survives token expiry and password resets, enumerate users, SharePoint, and OAuth grants via Microsoft Graph, and download SharePoint, OneDrive, and Exchange Online content at deliberately low rates (often under 1,000 files or messages per hour), with python-httpx seen in high-volume file access and compromised sessions reaching OfficeHome, SharePoint Online, Outlook Web, and internal applications within minutes. Microsoft attributes the initial access tradecraft to Storm-3121, linked to ShinyHunters and Falcon extortion operations, and Storm-3032, tied to BlackFile members now operating as Helix; Google Threat Intelligence tracks related activity as UNC6671, connected to the BlackFile, Helix, Falcon, Pink, and Redact extortion gangs, and Dark Reading reports access is passed to extortion groups such as ShinyHunters, with BYOD environments heightening exposure. CSO Online notes the passkey narrative is only the lure: phishable MFA was bypassed, not the passkey standard itself. In a parallel thread, ANY.RUN researchers uncovered the N0va phishkit, which imitates Microsoft Teams, SharePoint, OneDrive, DocuSign, Google Drive, Dropbox, Zoom, and Adobe Sign to draw victims into device-code authentication, captures access and refresh tokens after legitimate sign-in, and abuses token-exchange and device registration for persistent SSO access, targeting government, technology, consulting, and healthcare organizations in North America and the EU while evading MFA-focused detections. Separately, KnowBe4 Threat Lab observed 29,785 confirmed phishing emails between July and August 2026 abusing Microsoft 365 Direct Send to spoof…

• Microsoft has tracked the passkey-themed cloud intrusion campaign since May 2026; attackers call or SMS employees' personal phones impersonating IT helpdesk and urge urgent passkey, MFA, or SSO updates.
• Lures lead to adversary-in-the-middle phishing (capturing credentials and session tokens) or device-code authentication flows that grant actors OAuth tokens to attacker-controlled apps, exposing SSO apps including Salesforce, Slack, and…
• Observed lure domains include add-passkey[.]com, contoso.add-passkey[.]com (org names as subdomains), passkeyhelpdesk.com, and setupmypasskey.com; domains are often registered via Nicenic and go operational within hours.
• Persistence is achieved by registering attacker-controlled MFA methods (phone numbers, authenticator apps, software OTP), which survive stolen token expiry and password resets.
• Actors use Microsoft Graph to enumerate users, SharePoint, and OAuth grants, then collect SharePoint, OneDrive, and Exchange Online data at rates below 1,000 files or messages per hour; python-httpx appears in high-volume file access.
• Compromised sessions accessed OfficeHome, SharePoint Online, Outlook Web, and internal applications within minutes of compromise.
• Microsoft attributes the initial access tradecraft to Storm-3121 (feeding ShinyHunters and Falcon extortion operations) and Storm-3032 (BlackFile members now operating as Helix); Dark Reading reports access is handed to extortion groups…
• Google Threat Intelligence tracks related activity as UNC6671, linked to the BlackFile, Helix, Falcon, Pink, and Redact extortion gangs.