Passkey-Themed Phishing: How Data Is Stolen from Microsoft 365

Microsoft has reported a series of attacks in which threat actors linked to the ransomware groups ShinyHunters, Helix and several others use social engineering built around the theme of passkeys and single sign-on (SSO) to seize corporate accounts and steal data from Microsoft 365 services. The activity has been tracked since May 2026.

A lure that isn't really about passkeys

The attack begins with careful reconnaissance: the criminals gather information about employees and the company's structure from open sources — social media and professional profiles. They then call or message the victim, posing as corporate IT support, and insist that the target “urgently update a passkey, MFA or SSO settings,” or else lose access to their systems.

Curiously, the attackers make no attempt to register a passkey at all — that's merely the pretext. The real goal is to lure the person to a phishing page that mimics the Microsoft sign-in and to run an adversary-in-the-middle (AiTM) attack, or to get them to enter a code into the legitimate device-code authentication form. Either one hands the attackers a live session and tokens — with no passkey involved whatsoever.

To make it convincing, they register domains such as secure-passkey[.]com, setupmypasskey[.]com, keysyncos[.]com, and hide the victim company's name in a subdomain: company-name.secure-passkey[.]com. Microsoft attributes the activity to the groups Storm-3121 (linked to ShinyHunters and Falcon) and Storm-3032 (Helix, formerly BlackFile); all of it overlaps with the UNC6671 cluster previously described by Google.

What happens after sign-in

Once they have a session, the attacker spends just a few minutes surveying what the account can reach: My Apps, the profile, the sign-in management pages. Through the hijacked SSO, the way opens not only into SharePoint, Outlook and other Microsoft 365 services, but also into Salesforce, Google Workspace, Dropbox, SAP, Slack, Atlassian and a host of other connected applications.

To maintain a foothold, the criminals add their own MFA methods — phones, authenticator apps, software OTPs — so they can pass future checks without the victim's involvement. That said, a full reset of credentials and sessions wipes out such persistence.

Next comes Microsoft Graph: users, groups, privileged roles, applications, SharePoint sites, mailboxes and attachments are all enumerated. Requests like /users or /sites are routine in themselves, but what makes them suspicious is that the same token quickly rifles through resources, checks privileges and sign-in settings, and then moves on to files and messages.

The data collection is deliberately unhurried: not a smash-and-grab but a process stretched over hours or days, fewer than a thousand files an hour, so as to blend in with legitimate traffic. Automated collection from SharePoint and OneDrive is visible from the python-httpx user-agent.

What to do

Microsoft advises watching for atypical sign-ins followed by the registration of new MFA methods and reconnaissance via Graph. In the event of a compromise, revoke sessions and tokens, reset the password, and remove any authentication methods and mail rules added by the attacker. As preventive measures, it recommends phishing-resistant MFA, restricting access to sensitive resources to managed devices, and disabling device-code authentication where it isn't needed.

Source: Bleeping Computer