Microsoft has disclosed details of two distinct attack campaigns abusing trust in its cloud ecosystem. The first is a high-volume financial fraud operation that blasted over a million CEO-impersonation emails through third-party email delivery infrastructure. The second is an ongoing, more targeted campaign in which threat actors use passkey-themed social engineering — impersonating IT help desks — to hijack Microsoft 365 accounts, entrench persistence, and exfiltrate SharePoint, OneDrive, and email data, reportedly feeding downstream extortion operations.
Campaign 1: AI-Assisted CEO Fraud at Scale
Between August 3 and 5, 2026, Microsoft detected more than one million scam emails sent through legitimate third-party bulk email delivery infrastructure — a technique that helps messages pass basic sender-reputation and authentication checks because the underlying sending infrastructure has a legitimate track record. Roughly 88% of the messages targeted organizations in the United States, concentrated in IT services and business advisory, consumer goods, real estate, and discrete manufacturing.
The emails impersonated CEOs, CFOs, and company presidents across the sender display name, reply-to address, and signature, and asked accounts payable staff to process an Automated Clearing House (ACH) transfer of roughly $50,000 for a fabricated annual ServiceNow subscription. To add legitimacy, the messages included a forged invoice and a "forwarded" email thread appearing to show the impersonated executive corresponding with ServiceNow. Attackers registered lookalike domains, including service-nowinc[.]com and domainlify[.]net, for the scheme. Microsoft found no evidence that ServiceNow or any other legitimate organization was actually compromised or involved.
Microsoft also flagged structural indicators of generative AI use in the campaign — extensive HTML comments, uniform section labeling, and consistent formatting patterns repeated at scale across the sample — while noting it cannot independently confirm how much of the content a model produced.
Campaign 2: Passkey-Themed Social Engineering Against Cloud Identities
Separately, Microsoft has tracked an active intrusion campaign, ongoing since at least May 2026, that uses passkey and MFA-themed pretexts to breach Microsoft 365 accounts. Attackers research a target organization and its employees, then call or message them while impersonating the corporate IT help desk, claiming the employee must urgently update a passkey, MFA method, or SSO configuration to avoid losing access. Victims are often directed via SMS to phishing pages mimicking the Microsoft sign-in experience, hosted on domains such as passkeyhelpdesk[.]com, secure-passkey[.]com, setupmypasskey[.]com, add-passkey[.]com, integratedsso[.]com, oktasession[.]com, syncmykey[.]com, and portalsetuphub[.]com.
Microsoft attributes the activity to a range of actors including Storm-3121 (linked to onward ShinyHunters and Falcon extortion activity) and Storm-3032 (a splinter of the BlackFile group now operating under the Helix extortion brand). The tactics overlap with activity Google Threat Intelligence separately tracks as UNC6671.
Once inside an account, attackers typically register a new authentication method — an attacker-controlled phone number or authenticator app — to maintain persistent access even if the original password is later reset. From there they conduct reconnaissance through the Microsoft Graph API (directory, roles, and service principal enumeration), enumerate mailboxes and attachment metadata, and pull high volumes of files from SharePoint Online and OneDrive. Microsoft noted the exfiltration is deliberately throttled — often fewer than 1,000 files or emails per hour, sustained over several hours to multiple days — a pace consistent with evading simple volume-based detections.
How the "Passkey Phishing" Actually Works
It's important to be precise here: this is not a cryptographic break of passkeys or WebAuthn. Passkeys remain phishing-resistant by design because the private key never leaves the user's device and is bound to the legitimate site's origin — there is no evidence Microsoft's passkey implementation itself was defeated.
Instead, "passkey" is used purely as social-engineering bait. The help-desk impersonation call creates urgency around a fictitious passkey or MFA "update," then walks the victim toward one of two outcomes:
- Adversary-in-the-middle (AitM) proxying: The victim is sent to a phishing page that mimics the real Microsoft sign-in flow but silently proxies the session, capturing credentials and the resulting session token after the victim completes authentication.
- Device-code phishing: The victim is talked through the legitimate Microsoft device-code sign-in flow and told to enter a code generated by the attacker. Completing this on the real Microsoft login page hands the attacker a valid, authorized session — without the attacker ever touching the victim's password, passkey, or browser cookies.
In both cases, the actual passkey enrollment ceremony is never attacked; the term is a pretext used to get a victim to authorize a session or hand over credentials through an adjacent, non-cryptographic step in the login process.
Why This Matters
Both campaigns show attackers industrializing well-understood techniques rather than breaking new cryptographic ground. The email fraud campaign pairs generative AI content production with abuse of legitimate bulk-mail infrastructure to slip past reputation-based filters at massive scale. The identity campaign shows that phishing-resistant authentication only closes off the technical bypass — it does nothing to stop a human being talked into authorizing a session or approving an "update" over the phone. With persistence established via a newly registered MFA method, a single successful social-engineering call can lead to sustained, extortion-oriented data theft that looks like ordinary cloud activity if events are reviewed in isolation rather than correlated over time.
Mitigations and Protective Measures
For the identity/passkey campaign, Microsoft recommends:
- Enforcing Conditional Access policies that require managed, compliant devices for Exchange, SharePoint, and privileged Graph-based app access
- Blocking or tightly restricting device-code authentication and cross-tenant authentication transfer flows except where explicitly needed for business reasons
- Requiring out-of-band verification (a callback to a known number, not a number provided in the inbound message) before acting on any help-desk request to change authentication methods
- Alerting on new MFA/authentication-method registrations that follow an unusual or first-time sign-in
- Enabling Microsoft Graph activity logging and mailbox audit logging, and correlating unusual sign-ins, new auth-method enrollment, and bulk SharePoint/OneDrive downloads as a single incident rather than isolated events
- Disabling anonymous sharing links in SharePoint and OneDrive
- Training staff and help-desk personnel specifically on voice-phishing ("vishing") pretexts built around passkey, MFA, or SSO "updates"
For the invoice fraud campaign, Microsoft recommends:
- Properly configuring SPF, DKIM, and DMARC to reduce spoofing success
- Enabling automatic attack disruption and Zero-hour Auto Purge (ZAP) in Microsoft Defender for Office 365 to retroactively neutralize messages
- Applying mail flow connectors with enhanced filtering for bulk/third-party senders
- Requiring accounts payable staff to verify any ACH payment change or new-vendor invoice through a separate, previously known contact channel — never the reply-to address on the email itself
References
- Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data — The Hacker News
- Passkey-themed social engineering leads to identity and cloud compromise — Microsoft Security Blog
- Protecting organizations from AI-assisted executive impersonation and invoice fraud — Microsoft Security Blog