Passkey – Themed Phishing Campaign Targets Microsoft 365 Cloud Accounts for Credential Theft and Data Exfiltration

Microsoft has disclosed two distinct threat campaigns targeting enterprise users, primarily in the United States. The first campaign involved over one million scam emails sent between August 3 and 5, 2026, impersonating CEOs to trick accounts payable departments into initiating fraudulent ACH transfers for fake ServiceNow subscriptions. The second campaign, active since May 2026, uses passkey-themed social engineering to compromise Microsoft cloud accounts, followed by automated data exfiltration from SharePoint, OneDrive, and mailboxes through Microsoft Graph API. Victims span IT services, consumer goods, real estate, and discrete manufacturing sectors, with threat actors including Storm-3121, Storm-3032, and affiliates linked to the Cordial Spider cybercrime collective operating extortion brands like ShinyHunters, Falcon, and Helix.

The financial fraud campaign leverages generative AI to create convincing email templates that layer executive impersonation, vendor branding, fabricated invoices, and forged email threads into unified narratives designed to reduce recipient skepticism. Attackers register domains like service-nowinc[.]com and domainlify[.]net, research target organizations to identify CEOs and CFOs, then embed their names and email addresses into message signatures. The passkey phishing campaign begins with threat actors calling or messaging employees' personal phones, claiming to be IT help desk staff and urging immediate passkey or MFA updates to avoid access disruptions. Victims receive SMS messages redirecting them to counterfeit Microsoft sign-in pages hosted on domains like passkeyhelpdesk[.]com, secure-passkey[.]com, and setupmypasskey[.]com, which incorporate target company names as subdomains. These sites facilitate adversary-in-the-middle or device-code authentication flows, allowing attackers to capture credentials or trick users into granting access. In some cases, already-compromised accounts send similar passkey messages via Microsoft Teams to expand reach. Once inside, attackers register their own MFA methods—typically phone numbers, authenticator apps, or software OTP tokens—to establish persistence independent of the victim's participation.

This dual-campaign approach represents a significant escalation in cloud-focused attacks, combining traditional financial fraud with sophisticated identity compromise techniques that bypass modern authentication safeguards. The passkey phishing attacks are particularly concerning because they exploit user trust in legitimate security processes, using social engineering to guide victims through authentication flows that grant persistent access even after password resets. The threat actors demonstrate advanced operational security through extensive pre-attack reconnaissance using social networking and professional profiling platforms, plus investment in domain infrastructure that mimics legitimate identity management themes. Post-compromise activity includes high-volume Microsoft Graph API enumeration to inventory users, groups, permissions, and resources across tenants, mailbox message and attachment metadata inspection, privilege escalation reconnaissance targeting high-value accounts and service identities, and mass SharePoint Online and OneDrive downloads consistent with automated data exfiltration. The overlapping infrastructure and tactics across multiple threat groups suggest either shared phishing panels and voice-phishing services or splintered affiliates retaining access to common initial access playbooks, indicating a commoditized and scalable threat model that can be rapidly deployed against multiple organizations simultaneously.

Attack Surface

Cloud Service, Email, Office 365, Executive Impersonation

Tactics

Initial Access, Credential Access, Persistence, Defense Evasion, Collection, Exfiltration, Reconnaissance

Techniques

• T1566.002 – Phishing: Spearphishing Link
• T1534 – Internal Spearphishing
• T1586.002 – Compromise Accounts: Email Accounts
• T1621 – Multi-Factor Authentication Request Generation
• T1556.006 – Modify Authentication Process: Multi-Factor Authentication
• T1539 – Steal Web Session Cookie
• T1528 – Steal Application Access Token
• T1087 – Account Discovery
• T1069 – Permission Groups Discovery
• T1114.002 – Email Collection: Remote Email Collection
• T1530 – Data from Cloud Storage Object
• T1213.002 – Data from Information Repositories: Sharepoint
• T1567.002 – Exfiltration Over Web Service: Exfiltration to Cloud Storage
• T1598.003 – Phishing for Information: Spearphishing Link
• T1566.004 – Phishing: Spearphishing Voice

SuperPRO's Threat Countermeasures Procedures

1. Block all 17 campaign domains at the email gateway and web proxy — service-nowinc[.]com, domainlify[.]net, passkeyhelpdesk[.]com, secure-passkey[.]com, setupmypasskey[.]com, add-passkey[.]com, integratedsso[.]com, oktasession[.]com, keysyncos[.]com, oskeysync[.]com, oskeysetup[.]com, oskeyregister[.]com, syncmykey[.]com, myconnectkey[.]com, oskeyconnect[.]com, validationsetupac[.]com, and portalsetuphub[.]com — to prevent phishing delivery and credential-capture page access.
2. Configure Conditional Access policies in Microsoft Entra ID to block sign-ins from unmanaged devices and require compliant device registration for SharePoint Online, OneDrive, and Graph API access to prevent unauthorized data enumeration.
3. Enable Microsoft Entra ID Protection risk-based policies to automatically block or require step-up authentication for sign-ins flagged with unfamiliar properties, atypical travel, anonymous IP addresses, or password-spray patterns associated with these campaigns.
4. Audit all MFA method registrations in the past 90 days through Microsoft Entra ID sign-in logs and alert on phone number or authenticator app additions from anomalous locations, unmanaged devices, or immediately following help-desk-themed communications.
5. Restrict Microsoft Graph API permissions and implement application consent policies to prevent high-volume enumeration activity, limiting user and guest accounts to the minimum required scopes for SharePoint, OneDrive, and Exchange Online access.
6. Deploy email authentication controls including a DMARC policy set to reject for your domain to prevent CEO / executive impersonation, and configure transport rules to flag external emails containing executive names in display names or signatures.
7. Monitor for device-code authentication flows in Microsoft Entra ID sign-in logs (authentication protocol OAuth2DeviceCode) and alert on successful grants, especially when preceded by help-desk or IT-support-themed Teams messages or SMS activity to employee personal devices. Consider disabling device-code flow where it is not operationally required.

Source

Code Red Cyber / VTA – coderedcyber.ai