Microsoft has issued a warning regarding a series of passkey-themed phishing attacks that have led to the compromise of corporate Microsoft accounts and the theft of data from Microsoft 365 services. The activity, observed since May 2026, involves threat actors linked to various extortion gangs, including those tracked by Microsoft as Storm-3121 and Storm-3032, and by Google Threat Intelligence as UNC6671.
The attacks begin with extensive pre-attack research into targeted organizations and employees, often leveraging public sources like social networking platforms. Attackers then impersonate corporate IT help desks, contacting victims via phone calls or SMS messages to their personal devices. They instruct employees to urgently update passkey, multi-factor authentication (MFA), or single sign-on (SSO) configurations to prevent loss of system access.
Victims are directed to sophisticated phishing sites designed to mimic legitimate Microsoft login pages. While the lures frequently mention passkeys, the attackers are not attempting to enroll a passkey. Instead, they use these themes to trick employees into signing into adversary-in-the-middle (AiTM) phishing sites or to authorize access via device-code authentication flows. AiTM attacks capture credentials and session tokens, while device-code phishing convinces victims to authorize an attacker-controlled client through Microsoft's legitimate authentication pages, granting access without further MFA challenges.
Phishing domains registered by the attackers often combine company names with terms like "passkey," "SSO," "key synchronization," and "identity verification." Examples include `passkeyhelpdesk[.]com`, `secure-passkey[.]com`, `setupmypasskey[.]com`, `add-passkey[.]com`, `integratedsso[.]com`, `oktasession[.]com`, `keysyncos[.]com`, and `oskeysync[.]com`. These often incorporate the victim company's name as a subdomain (e.g., `company-name.secure-passkey[.]com`) to enhance credibility.
Microsoft attributes the initial access activity to multiple threat actors within the same extortion ecosystem. Storm-3121 is associated with ShinyHunters and Falcon extortion, while Storm-3032 is believed to be linked to former BlackFile extortion group members now operating under the Helix name. This activity aligns with previous reports from Google Threat Intelligence concerning UNC6671, which Google has also connected to extortion groups like BlackFile, Helix, Falcon, Pink, and Redact.
Once an account is compromised, attackers establish a valid session, often from an unmanaged device, and immediately begin reconnaissance. Microsoft observed suspicious sign-ins to Microsoft 365 services, identified in Entra logs as "OfficeHome," associated with the Office 365 portal's shared infrastructure. Within minutes, the attackers access "My Apps," "My Profile," Microsoft Approval Management, account-management interfaces, and "My Sign-Ins" to enumerate accessible resources.
Further post-compromise activity includes accessing SharePoint Online, Outlook Web, Microsoft 365 collaboration and search services, internal business applications, and virtual desktop authentication flows. Attackers then establish persistence by adding their own MFA methods, such as new phone numbers, authenticator applications, or software-based one-time password tokens, allowing them to bypass future MFA challenges. This persistence, however, does not survive a complete credential and session reset.
Attackers extensively use Microsoft Graph to enumerate the cloud environment, querying for organizations, licenses, enabled services, users, groups, directory roles, privileged accounts, registered authentication methods, applications, service principals, OAuth permissions, application role assignments, SharePoint sites, document libraries, folders, files, OneDrive resources, mail folders, messages, and attachments. While individual Graph requests like `/users` or `/groups` are common, suspicious activity is indicated when the same account, application, or access token rapidly moves across different resources, checks privileges and authentication settings, and then accesses email, attachments, files, or documents.
Following reconnaissance, attackers proceed to data exfiltration from Microsoft 365. Microsoft observed high-volume access and download activity targeting Microsoft SharePoint Online and Microsoft OneDrive for Business, with some intrusions extending into Microsoft Exchange Online via REST API-based access to email content. This activity generates significant volumes of `FileAccessed` and `FileDownloaded` events, indicating systematic retrieval of cloud-hosted documents and organizational data.
The data theft appears automated, with connections often using the `python-httpx` user agent during SharePoint and OneDrive access. Attackers avoid rapid "smash-and-grab" exfiltration to evade detection, instead spreading data theft over several hours to multiple days, accessing fewer than 1,000 files or emails per hour to blend with legitimate traffic.
Microsoft advises organizations to monitor for unusual sign-ins followed by new MFA registrations, Microsoft Graph reconnaissance, and suspicious access to SharePoint, OneDrive, or Exchange. In the event of a compromise, administrators should revoke active sessions and tokens, reset credentials, remove any attacker-added authentication methods or mailbox rules, and require users to re-register their authentication methods.
