Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data

1. Executive summary

Microsoft Security Research has disclosed two concurrent campaigns: a business email compromise (BEC) operation that sent over one million CEO-impersonation scam emails between 3–5 August 2026 targeting accounts payable departments, and a passkey-themed social engineering campaign, tracked since May 2026, that compromises Microsoft cloud identities via adversary-in-the-middle (AiTM) and device-code authentication flows. The second campaign is the material risk to EMEA financial services clients: after gaining access, actors add their own authentication methods, perform high-volume Microsoft Graph reconnaissance, download SharePoint and OneDrive content, and collect mail via REST APIs — activity consistent with automated collection and potential exfiltration. No CVE is involved and no CISA KEV entry applies; this is an identity and process-control failure, not a patchable vulnerability. No VERIFIED REFERENCE DATA was resolved for this item, so no CVSS score, severity rating, or KEV exploitation state is asserted here — clients should treat the risk as high on the basis of observed post-compromise data access, not a numeric score. Attribution is unconfirmed: Microsoft describes the activity generically, and the only named actor (the "Pink" extortion crew, per a separate Help Net Security report) has no MITRE ATT&CK profile in our reference data — treat that linkage as unconfirmed.

2. Regulatory framing

No DORA Art. 28/29/30 or NIS2 Art. 21(2)(d) row is asserted: the source does not establish a third-party/supply-chain failure at the client — the abused infrastructure (third-party email delivery, Nicenic-registered domains) belongs to the attacker, not to a client ICT provider. Do not map this to third-party risk articles on the basis of the attacker's infrastructure alone.

3. Technical analysis & attack chain

Two distinct campaigns are described. They share a theme (impersonation, trusted-infrastructure abuse) but differ in objective and mechanism.

Campaign A — CEO-impersonation invoice/ACH fraud (3–5 August 2026)

1. Actors register impersonation domains (examples given: service-nowinc[.]com, domainlify[.]net).
2. They send executive-themed payment requests through trusted third-party email delivery infrastructure, masquerading as CEOs of target companies.
3. Emails carry a fabricated ServiceNow annual-subscription invoice, a purported "approval" of that invoice, and a forged supporting email thread to reduce recipient skepticism.
4. Signatures are populated with the real names and email addresses of the victim organisation's CEO, CFO, and president, harvested to make the request look internal.
5. The lure asks accounts payable to initiate an ACH transfer for the supposed subscription.
6. Microsoft states evidence indicates generative AI was used to create email templates and draft recipient-tailored emails.

Targeting was primarily US enterprise users across IT services, consumer goods, real estate, and discrete manufacturing. Volume exceeded one million emails. No malware, exploit, or CVE is involved — this is pure social engineering and payment fraud.

Campaign B — passkey-themed identity and cloud compromise (tracked since May 2026)

1. Initial contact: a call or SMS to the employee's personal phone number, with the caller claiming to be internal IT helpdesk. The pretext is urgency: a passkey, MFA, or SSO configuration must be updated immediately to avoid access disruption.
2. Pre-attack research: Microsoft assesses the actor invests heavily in reconnaissance of employees and org structure from public sources (social networking, professional profiling platforms).
3. Lure delivery: the victim is directed via SMS to a counterfeit site mimicking the Microsoft sign-in experience. Domains are typically generic registrations with the target organisation's name embedded as a subdomain, and multiple domains are created per organisation to allow infrastructure rotation. Domains are often registered with Nicenic and operational within hours.
4. Credential/token capture: despite the passkey framing, passkey enrolment is usually not the objective. The narrative is a pretext to drive the victim through either (a) an AiTM flow, capturing credentials and session tokens, or (b) a device-code authentication flow, in which the victim unknowingly authorises access on the actor's behalf.
5. Persistence: actors add their own authentication methods to the compromised identity.
6. Reconnaissance and collection: high-volume Microsoft Graph activity, SharePoint and OneDrive downloads, and mailbox collection through REST APIs. Microsoft assesses this as consistent with automated collection from compromised cloud identities using proxy-associated infrastructure.
7. Lateral expansion (smaller number of cases): using an already-compromised trusted employee identity, actors send the same passkey-themed messages through Microsoft Teams to increase engagement likelihood.

Forensic visibility caveat (important for responders): if the victim opens the phishing link on a personal mobile device not onboarded to Microsoft Defender for Endpoint, the related activity may be absent from endpoint telemetry. In many investigations the employee's recollection of the call or text is the earliest — sometimes only — evidence of initial access. Reconstruction therefore depends on correlating that report with subsequent sign-ins, device-code authentication events, token activity, and authentication-method changes.

Corroborating context (separate sources, not part of the Microsoft disclosure)

• Check Point (via Help Net Security, 30 July 2026) observed over 200 phishing emails targeting ~120 organisations between 25 June and the second week of July 2026, abusing Microsoft's own authentication system rather than fake login pages, using a Microsoft Planner task-assignment lure. This corroborates the broader "abuse the legitimate auth path" trend but is a distinct campaign — do not conflate it with the passkey activity.
• Help Net Security (10 September 2026) reports Microsoft Security Research tracking a campaign since May 2026 in which attackers call/text employees' personal phones posing as IT, then pull files and email from Microsoft 365, SharePoint, OneDrive, and inboxes "for weeks at a time." This is consistent with Campaign B and likely the same body of work, but the source does not explicitly state they are identical.
• Help Net Security (9 July 2026) attributes a fake-Entra-passkey-enrolment vishing campaign to the "Pink" cyber extortion crew. This attribution is single-sourced and unconfirmed — no MITRE ATT&CK profile exists for "Pink" in our reference data, and Microsoft's own disclosure does not name an actor. Do not treat the Pink linkage as established.
• The Record (Recorded Future) reports Microsoft analysis of invoice-scam emails that "doubled-up on tactics," including AI assistance — consistent with Campaign A.

4. Mitigation & containment

P1 — within 24 hours

• Hunt for the Campaign B sequence in identity and cloud logs. Query for: unusual sign-ins followed by authentication-method additions on the same identity; device-code authentication events; high-volume Microsoft Graph calls; bulk SharePoint/OneDrive downloads; mailbox collection via REST APIs. Microsoft explicitly recommends investigating this sequence across identity, Microsoft Graph, SharePoint, OneDrive, and Exchange signals rather than chasing rotating domains/IPs.
• For any confirmed compromise: revoke sessions and remove unauthorised authentication methods. This is Microsoft's stated remediation and is the single highest-value action — persistence lives in the added auth methods, so password resets alone are insufficient.
• Block the two named impersonation domains at email gateway and DNS/proxy: service-nowinc[.]com, domainlify[.]net.
• Brief finance/accounts payable immediately on the CEO-impersonation ACH pattern: fabricated ServiceNow subscription invoices, forged approval, forged email thread, real executive names in signatures. Enforce a callback verification procedure to a known-good number for any payment instruction or bank-detail change — never a number supplied in the email.

P2 — within 72 hours

• Harden the device-code flow. Device-code authentication is a legitimate but frequently abused path; restrict or monitor it per your tenant's needs and alert on device-code sign-ins that are not part of an approved enrolment process.
• Enforce phishing-resistant MFA (FIDO2/passkey) properly — and note the irony the source makes explicit: the passkey narrative is the lure, so a workforce trained to "expect a passkey setup call" is a workforce primed for this pretext. Train staff that IT will never cold-call a personal phone to walk them through passkey/MFA/SSO reconfiguration, and that no legitimate flow requires them to enter credentials on a page reached from an SMS link.
• Extend conditional access to unmanaged/personal devices. The source notes that personal mobile devices not onboarded to Defender for Endpoint produce no endpoint telemetry — treat personal-device access to corporate cloud apps as a monitored, restricted path.
• Monitor Microsoft Teams for internal passkey-themed messages from compromised accounts; the actor's lateral move uses trusted internal identity, so sender-reputation filtering will not catch it.

P3 — within 7 days

• Build detection around the durable sequence, not the infrastructure. Microsoft's own guidance: domains, IPs, and hosting providers change quickly; the recurring sequence of identity compromise → persistence → reconnaissance → content discovery → exfiltration is the stable detection basis.
• Review email authentication posture (SPF/DKIM/DMARC) and third-party email delivery trust — Campaign A abused trusted delivery infrastructure, so gateway allow-listing of bulk senders is a live risk.
• Rehearse the incident-management and reporting path (DORA Art. 17/19; NIS2 Art. 23 where in scope) against this scenario, including the "weeks-long dwell time" case, since classification depends on scope and duration.

5. Indicators of compromise

No file hashes, IP addresses, or email addresses are present in the source material. The two domains above are the only atomic indicators provided. Treat as single-sourced (The Hacker News reporting Microsoft's disclosure); verify before enforcement.

domain  service-nowinc[.]com
domain  domainlify[.]net

Behavioural indicators

6. Detection

The sources provide no file artefacts, command lines, mutexes, or registry keys — this is a cloud-identity campaign, so a YARA file rule is not appropriate. Detection belongs in identity and cloud audit logs. The Sigma rule below targets the Microsoft-stated sequence (sign-in followed by authentication-method registration); field names are illustrative of common Entra ID audit schemas and should be mapped to your tenant's actual log field names before deployment.

title: Entra ID Authentication Method Registered Following Unusual Sign-In
id: 8f2c1a44-9d3e-4b71-a6c0-5e7b2d9f1c33
status: experimental
description: >
  Detects registration of a new authentication method on an identity, the
  persistence step Microsoft Security Research describes in passkey-themed
  social engineering intrusions that lead to cloud identity compromise.
  Correlate with a preceding unusual sign-in or device-code authentication
  event for higher fidelity.
author: Adverse Trace
date: 2026-09-13
references:

  - https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/
  - https://thehackernews.com/2026/09/attackers-use-passkey-phishing-to.html
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    operationName:

      - 'Update user'
      - 'Add registered device'
      - 'Add registered owner to device'
      - 'Add strong authentication method'
      - 'Register authentication method'
  condition: selection
falsepositives:

  - Legitimate user self-service MFA/passkey enrolment
  - Helpdesk-driven authentication method resets
level: medium
tags:

  - attack.persistence
  - attack.initial_access
  - attack.t1098
  - attack.t1078

Correlation guidance (not a rule, but the higher-value detection): alert on the sequence — an unusual or device-code sign-in on an identity, followed within a short window by an authentication-method addition, followed by elevated Graph/SharePoint/OneDrive/mailbox activity. Any single event is noisy; the sequence is the signal Microsoft identifies as durable.

7. Sources

• Microsoft Threat Intelligence — Passkey-themed social engineering leads to identity and cloud compromise — https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/ — 2026-09-09
• The Hacker News — Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data — https://thehackernews.com/2026/09/attackers-use-passkey-phishing-to.html — 2026-09-13
• Help Net Security — Attackers call employees' personal phones to break into Microsoft 365 accounts — https://www.helpnetsecurity.com/2026/09/10/microsoft-365-social-engineering-personal-phones/ — 2026-09-10
• Help Net Security — Extortion crew hijacks Microsoft 365 accounts via fake passkey setup — https://www.helpnetsecurity.com/2026/07/09/microsoft-365-fake-passkey-setup-enrollment/ — 2026-07-09
• Help Net Security — Attackers are using Microsoft's legitimate login system to camouflage phishing attacks — https://www.helpnetsecurity.com/2026/07/30/microsoft-authentication-system-phishing/ — 2026-07-30
• The Record (Recorded Future) — Microsoft sees some new wrinkles in invoice-scam emails — https://therecord.media/invoice-scam-emails-new-features-microsoft-researchers
• The Hacker News — Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails — https://thehackernews.com/2026/08/microsoft-365-aitm-phishing-hijacks.html

8. Adverse Trace position

We assess this as a high-priority identity and process-control threat for EMEA financial services clients, with the caveat that no VERIFIED REFERENCE DATA was resolved for this item, so we assert no CVSS score, severity rating, or CISA KEV state — the risk rests on observed post-compromise data access (Graph collection, SharePoint/OneDrive downloads, mailbox collection via REST APIs) and multi-week dwell times, not on a scored vulnerability. The passkey-themed campaign is the material concern: it defeats credential-focused controls by capturing session tokens and by abusing a legitimate authentication path, and it leaves minimal endpoint telemetry when the victim uses a personal device. The CEO-impersonation ACH campaign is lower-technical-complexity but directly targets payment workflows and is AI-assisted at scale. Attribution is unconfirmed — Microsoft names no actor, and the "Pink" extortion crew linkage is single-sourced with no MITRE profile in our data; do not act on it as established. The two domains in §5 are single-sourced; verify before enforcement. Next, we will monitor for corroborating vendor reporting on the actor identity, watch for additional impersonation domains tied to the ServiceNow invoice lure, and update this advisory if Microsoft or a second independent source confirms attribution or publishes additional atomic indicators. Clients who identify the §3 sequence in their own telemetry should revoke sessions and remove unauthorised authentication methods first, then engage their DORA Art. 17/19 and, where in scope, NIS2 Art. 23 processes.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.