A New Social Engineering Angle
Microsoft has disclosed an ongoing phishing campaign, active since May 2026, in which threat actors affiliated with ShinyHunters, Helix, and other extortion groups impersonate IT help desk staff to compromise corporate Microsoft 365 accounts. The twist is the pretext: rather than the usual "your password has expired" lure, attackers claim employees must urgently update their passkey or multi-factor authentication configuration — a topic framed as a security upgrade, making targets more willing to comply quickly.
How the Attacks Work
Despite the passkey branding, the actual credential theft relies on two well-established but effective techniques:
1. Adversary-in-the-Middle (AiTM)
Victims are directed to convincing fake Microsoft login pages that proxy the real authentication flow, capturing both credentials and live session tokens — enough to bypass standard MFA entirely.
2. Device Code Phishing
Victims are tricked into approving a device-code authentication request through legitimate Microsoft authentication pages, which grants the attacker's application access to the account without ever touching a fake login page.
Reconnaissance and Targeting
Microsoft notes the attackers perform substantial pre-attack reconnaissance, gathering employee names, roles, and org structure from public sources before making contact by phone or SMS. Phishing domains are crafted to look organization-specific, often combining the target company's name with terms like "passkeyhelpdesk" or "secure-passkey," or embedding the victim's organization name as a subdomain to increase legitimacy.
Post-Compromise Activity
Once inside a Microsoft 365 tenant, the attackers follow a consistent playbook:
- Register their own MFA method on the compromised account to maintain persistent access even if the original password is reset
- Use Microsoft Graph API calls to enumerate the broader cloud environment — mailboxes, SharePoint sites, group memberships
- Exfiltrate data systematically from SharePoint, OneDrive, and Exchange over hours or days, pacing activity to avoid triggering volume-based detection
Microsoft's Recommendations
- Implement phishing-resistant MFA (FIDO2 security keys, platform passkeys) rather than SMS or push-based MFA that remains vulnerable to AiTM relay
- Restrict access to sensitive resources to managed, compliant devices
- Disable device-code authentication entirely where it isn't a required business workflow
- Monitor for suspicious sign-ins followed closely by new MFA method registrations — a strong indicator of post-compromise persistence
Why This Matters
This campaign illustrates how attackers continuously repackage the same underlying techniques — AiTM proxying and device-code abuse — behind whatever authentication trend is currently top-of-mind for defenders. As organizations roll out passkeys as a phishing-resistant improvement, attackers are already exploiting the rollout confusion itself as a social engineering vector, rather than attacking passkeys technically.
Security teams migrating to passkeys should pair the technical rollout with employee awareness training that explicitly addresses these help-desk impersonation lures.