Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data
Summary: Microsoft disclosed two campaigns: one sent over a million CEO-impersonation scam emails between August 3 and 5, 2026, targeting accounts payable staff at U.S. firms in IT services, consumer goods, real estate, and discrete manufacturing with fabricated ServiceNow invoices and forged email threads to prompt ACH transfers. The second, detected since May 2026, uses help-desk pretext calls and texts to personal phones directing employees to counterfeit Microsoft sign-in pages, then adds attacker-controlled MFA methods and performs high-volume Microsoft Graph, SharePoint, and OneDrive collection.
What's compelling: The passkey lure defeats MFA without stealing credentials or cookies through device-code phishing, and once the actor registers a new phone number or authenticator, unrevoked sessions keep the foothold alive even after the password is reset. Microsoft attributes the initial access to Storm-3121 and Storm-3032, the latter tied to the Helix extortion brand and UNC6671, whose credential-harvesting panels use victim-named subdomains to make voice phishing convincing.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026