Passkey-themed phishing and device-code kits compromise Microsoft 365 accounts despite MFA, feeding extortion operations

Microsoft attributes passkey-themed IT-helpdesk vishing active since May 2026 to Storm-3121 and Storm-3032 (linked to ShinyHunters/Falcon and Helix/BlackFile; also tracked as UNC6671); AiTM and device-code phishing capture M365 sessions despite MFA, enabling…

Microsoft Security Research has tracked cloud intrusions since May 2026 in which attackers call or text employees' personal phones posing as IT help desk staff, using fake passkey, MFA, or SSO enrollment lures to steer victims to adversary-in-the-middle phishing pages or device-code authentication flows that capture credentials, session tokens, and OAuth tokens even when MFA succeeds. Microsoft attributes initial access to Storm-3121, which feeds ShinyHunters and Falcon extortion operations, and Storm-3032, the Helix extortion operation descended from BlackFile; Google Threat Intelligence tracks related activity as UNC6671, linked to the BlackFile, Helix, Falcon, Pink, and Redact gangs. Dark Reading adds that the voice-led social engineering exploits BYOD scenarios, with access passed to extortion groups such as ShinyHunters, though victim counts are unspecified. Post-compromise, attackers register their own MFA methods for persistence that survives token expiry and password resets, enumerate users, SharePoint, and OAuth grants via Microsoft Graph, and pull SharePoint, OneDrive, and Exchange data below 1,000 items per hour using python-httpx automation; observed lure domains include passkeyhelpdesk.com and setupmypasskey.com, device-code phishing exposes Salesforce, Slack, Dropbox, and other SSO apps, and compromised sessions reached OfficeHome, SharePoint Online, Outlook Web, and internal applications within minutes. Related kit activity includes N0va, tracked by ANY.RUN via a /api/verification/init pattern and targeting government, technology, consulting, and healthcare organizations in North America and Europe with Teams, SharePoint, OneDrive, DocuSign, Google Drive, Dropbox, Zoom, and Adobe Sign lures, and GhostCode, identified by eSentire in late August, which uses NDA-pretext contact-form lures and password-protected HTML attachments to run device-code phishing that harvests a Primary Refresh Token in 32 seconds and registers three devices in 78 seconds via the Microsoft Authentication Broker app ID, GHOSTnet-linked infrastructure, and residential proxies matching the victim's location. Barracuda separately documents DocuSign-themed emails with calendar invites that route through a Microsoft OAuth endpoint into Teams and render a locally assembled blob-URL sign-in page with service workers and sandboxed iframe execution, evading URL-reputation checks to steal credentials without exploiting a Teams flaw. KnowBe4 counted 29,785 confirmed phishing…

• Microsoft has tracked the passkey-themed helpdesk vishing, AiTM phishing, and device-code intrusion set since May 2026.
• Attribution: Storm-3121 feeds ShinyHunters and Falcon extortion operations; Storm-3032 is the Helix operation descended from BlackFile; Google Threat Intelligence tracks related activity as UNC6671, linked to BlackFile, Helix, Falcon,…
• Attackers impersonate IT staff on victims' personal phones with passkey, MFA, or SSO lures; phishable MFA is bypassed, not the passkey standard itself.
• Post-compromise persistence uses attacker-registered authenticator apps, phone numbers, and software OTP methods, surviving stolen-token expiry and password resets.
• Microsoft Graph is abused to enumerate tenants, users, and OAuth grants; SharePoint, OneDrive, and Exchange data is exfiltrated below 1,000 files/emails per hour using a python-httpx user agent.
• Observed lure domains include passkeyhelpdesk.com and setupmypasskey.com; compromised sessions accessed OfficeHome, SharePoint Online, Outlook Web, and internal applications within minutes.
• Dark Reading reports the voice-led social engineering exploits BYOD scenarios, with access sold to extortion groups including ShinyHunters; victim counts are not specified.
• GhostCode (eSentire, identified late August) harvests a Primary Refresh Token in 32 seconds and registers three devices in 78 seconds via the Microsoft Authentication Broker app ID, using password-protected HTML attachments, encrypted…