Threat actors operating within extortion-focused criminal ecosystems are deploying passkey and single sign-on-themed social engineering to compromise corporate Microsoft accounts and extract sensitive information from Microsoft 365 infrastructure, according to Microsoft's latest threat research.
The campaign, tracked since May 2026, follows a consistent pattern: attackers conduct detailed reconnaissance of target organizations and their personnel using publicly available sources, then contact employees via phone or messaging while posing as corporate IT support staff. The fraudsters pressure victims to immediately update passkey, MFA, or SSO settings under the guise of preventing account lockouts.
Employees receive links to counterfeit Microsoft login portals, frequently delivered through SMS to personal mobile devices. Though passkeys feature prominently in the social engineering narrative, the attackers are not actually attempting to enroll them. Instead, the passkey pretext serves as cover to redirect victims to adversary-in-the-middle phishing sites or device-code authentication flows that capture credentials and session tokens.
Microsoft notes that "The actor appears to invest heavily in pre-attack research, likely gathering information about employees and organizational structure from public sources such as social networking and professional profiling platforms."
The threat actors register malicious domains combining company names with passkey-related terminology, SSO language, and identity verification keywords. Observed examples include passkeyhelpdesk[.]com, secure-passkey[.]com, setupmypasskey[.]com, add-passkey[.]com, integratedsso[.]com, oktasession[.]com, keysyncos[.]com, and oskeysync[.]com. To enhance credibility, attackers frequently embed victim organization names in subdomains, such as company-name.secure-passkey[.]com.
Microsoft attributes this initial-access activity to multiple threat actors within the same extortion ecosystem. Storm-3121, connected to ShinyHunters and Falcon extortion operations, and Storm-3032, believed linked to BlackFile members now operating under the Helix banner, are primary actors. This campaign overlaps with activity previously documented by Google Threat Intelligence as the UNC6671 threat cluster, which Google has connected to BlackFile, Helix, Falcon, Pink, and Redact extortion groups.
Post-compromise activity in Microsoft cloud environments
Microsoft's investigation reveals the operational patterns attackers follow once they gain account access. In one documented case, a suspicious sign-in from an unmanaged device to the OfficeHome service—associated with the Office 365 portal's shared infrastructure and browser-based Office applications—appeared in Entra logs.
Following MFA completion, the attacker established a persistent session and immediately began probing accessible resources. Within minutes, the session accessed My Apps to view assigned applications, My Profile for organizational details, Microsoft Approval Management, account-management interfaces, and My Sign-Ins. The attacker subsequently accessed SharePoint Online, Outlook Web, Microsoft 365 collaboration and search services, an internal business application, and virtual desktop authentication flows. The session remained active for approximately one hour while the attacker enumerated sensitive files and internal applications.
In another intrusion, device-code phishing succeeded in obtaining an authentication token. The victim was manipulated into entering an attacker-supplied code into Microsoft's legitimate authentication interface, which issued a token to an attacker-controlled OAuth application. This granted the threat actor full access to the victim's account and all connected SSO applications—including Microsoft 365, Salesforce, Google Workspace, Dropbox, Adobe, SAP, Slack, Zendesk, and Atlassian—without requiring additional MFA verification.
A third attack leveraged previously compromised credentials for an account where an authenticator application had been registered days prior. The threat actor performed reconnaissance using an automated Node.js system and Microsoft Graph API calls.
Establishing persistence and conducting reconnaissance
Once inside compromised accounts, attackers typically establish persistence mechanisms by registering new phone numbers, authenticator applications, and software-based one-time password tokens. This approach allows them to satisfy future MFA challenges without victim involvement, though Microsoft notes such persistence does not survive a complete credential and session reset.
Attackers then deploy Microsoft Graph to systematically enumerate the victim's cloud environment. Microsoft observed Graph requests targeting:
- Organizations, licenses, and enabled services
- Users, groups, and group membership
- Directory roles and privileged accounts
- Registered authentication methods
- Applications and service principals
- OAuth permissions and application role assignments
- SharePoint sites, document libraries, folders, and files
- OneDrive resources
- Mail folders, messages, and attachments
While Graph requests such as /users, /groups, or /sites are routine in enterprise environments and may not trigger alerts individually, the activity becomes conspicuous when a single account, application, or access token rapidly traverses multiple resources, checks privilege levels and authentication configurations, and then begins accessing email, attachments, files, or documents.
Data exfiltration tactics
Following reconnaissance, attackers shift focus to large-scale data collection from Microsoft 365. Microsoft observed that "high-volume access and download activity targeting Microsoft SharePoint Online and Microsoft OneDrive for Business, with some intrusions extending into Microsoft Exchange Online through REST API-based access to email content" occurred during these operations.
SharePoint and OneDrive activity generated substantial volumes of FileAccessed and FileDownloaded events, indicating systematic retrieval of cloud-stored documents and organizational data. The activity appears automated, with connections using the python-httpx user agent during exfiltration operations.
Rather than conducting rapid "smash-and-grab" exfiltration that risks detection, attackers stretch data theft across hours or multiple days, accessing fewer than 1,000 files or emails per hour to blend with legitimate traffic patterns.
Detection and mitigation recommendations
Microsoft recommends monitoring for unusual sign-in patterns followed by new MFA registrations, Microsoft Graph reconnaissance activity, and suspicious access to SharePoint, OneDrive, or Exchange resources.
When account compromise is confirmed, administrators should revoke active sessions and tokens, reset credentials, remove any authentication methods or mailbox rules created by attackers, and require users to re-register their authentication methods.
Preventive measures include deploying phishing-resistant MFA, restricting sensitive cloud resources to managed devices, and disabling device-code authentication where operationally feasible.
Source: BleepingComputer