Clarissa Hana
Microsoft is alerting organizations to a surge in highly targeted social engineering campaigns, primarily by threat actors linked to the ShinyHunters and Helix extortion gangs, that are exploiting passkey and single sign-on (SSO) themes to compromise corporate Microsoft 365 accounts and exfiltrate sensitive data. This wave of malicious activity, observed since May 2026, represents a significant evolution in attacker tactics, moving beyond simple credential harvesting to more intricate methods that leverage legitimate authentication flows.
The Evolving Threat Landscape: A Deeper Dive into Passkey and SSO Exploitation
The sophisticated nature of these attacks lies in the threat actors’ meticulous pre-attack reconnaissance. These groups dedicate considerable effort to researching targeted organizations, meticulously gathering intelligence on employees and organizational structures from publicly available sources, including social networking and professional profiling platforms. This deep understanding allows them to craft highly convincing social engineering lures.
The attack typically commences with threat actors impersonating corporate IT help desks, initiating contact through phone calls or messaging. They inform unsuspecting employees that an urgent update to their passkey, multi-factor authentication (MFA), or single sign-on (SSO) configuration is required to prevent imminent loss of access to critical corporate systems. This creates a sense of urgency and compels victims to act without due diligence.
Following this initial contact, victims are directed to meticulously designed phishing websites. These sites are crafted to mimic legitimate Microsoft login pages, often with the malicious links delivered via SMS messages to employees’ personal phones, blurring the lines between professional and personal communication channels.
Deconstructing the Deception: Beyond Passkey Enrollment
Despite the prevalent use of "passkey" in their lures, Microsoft clarifies that the attackers are not actually attempting to enroll passkeys for compromised accounts. Instead, these passkey-themed phishing pages serve as a sophisticated gateway to more advanced attack vectors. The primary objectives are to trick targeted employees into signing in to adversary-in-the-middle (AiTM) phishing sites or to manipulate them into participating in device-code authentication flows.
AiTM attacks are particularly insidious because they enable threat actors to capture not only user credentials but also valuable session tokens. These tokens, once obtained, can allow attackers to bypass subsequent authentication steps and maintain access to compromised accounts as if they were the legitimate user.
Device-code phishing, another technique employed, tricks victims into authorizing access to their accounts through an attacker-controlled client. This is achieved by directing users to Microsoft’s legitimate authentication pages and prompting them to enter a specific code, effectively granting the attacker a legitimate pathway into the victim’s environment.
Crafting the Illusion: The Art of Phishing Domain Registration
A critical component of these attacks is the creation of deceptive phishing domains. Threat actors register domains that strategically combine company names with keywords associated with passkeys, SSO, key synchronization, account setup, and identity verification. Microsoft has identified several examples of these domains, including: passkeyhelpdesk[.]com, secure-passkey[.]com, setupmypasskey[.]com, add-passkey[.]com, integratedsso[.]com, oktasession[.]com, keysyncos[.]com, and oskeysync[.]com.
To further enhance the believability of these fake portals, attackers commonly embed the victim company’s name within a subdomain. For instance, a domain might appear as company-name.secure-passkey[.]com. This tactic leverages the familiarity of the company name to bypass initial user skepticism and increase the likelihood of successful credential compromise.
The Ecosystem of Attackers: Interconnected Extortion Groups
Microsoft attributes this initial-access activity to a network of interconnected threat actors operating within the same broad extortion ecosystem. These include groups tracked by Microsoft as Storm-3121 and Storm-3032.
Storm-3121 has been linked to the ShinyHunters group, known for its involvement in data breaches and extortion, and is associated with Falcon extortion activities. Meanwhile, Storm-3032 is believed to be connected to former members of the BlackFile extortion group, who are now operating under the Helix moniker.
This observed activity shows significant overlap with attacks previously documented by Google Threat Intelligence under the UNC6671 threat cluster. Google’s earlier reporting detailed how UNC6671 employed phone-based social engineering and passkey-themed phishing infrastructure to compromise corporate identities, subsequently gaining access to enterprise cloud environments. Google has also associated UNC6671 with the same range of extortion gangs, including BlackFile, Helix, Falcon, Pink, and Redact, underscoring a coordinated and evolving threat landscape.
Mapping the Compromised Landscape: Post-Exploitation Tactics
Microsoft’s in-depth research provides a detailed look into the activities undertaken by threat actors once they gain unauthorized access to Microsoft cloud environments. In one investigated incident, Microsoft observed a suspicious sign-in from an unmanaged device to a Microsoft 365 service identified in Entra logs as "OfficeHome." This service is linked to the shared infrastructure of the Office 365 portal, including browser-accessed Office applications.
After successfully completing MFA, the attacker established a valid session and began an immediate reconnaissance phase. Within minutes, the compromised session was leveraged to explore the accessible resources. This included accessing "My Apps" to identify assigned applications, "My Profile" for organizational information, Microsoft Approval Management, account management interfaces, and "My Sign-Ins" to understand past authentication activities.
The threat actor then proceeded to access critical services such as SharePoint Online, Outlook Web, Microsoft 365 collaboration and search services, an internal business application, and authentication flows associated with virtual desktops. This reconnaissance phase, lasting approximately one hour, was characterized by the systematic listing of sensitive files and internal applications, demonstrating a clear intent to map out valuable data and infrastructure.
The Device-Code Phishing Vector: A Bypass of Traditional Defenses
In another observed attack scenario, the passkey social engineering attacks culminated in device-code phishing. Here, victims were manipulated into entering a specific code provided by the attacker into Microsoft’s legitimate authentication page. This action issues an authentication token to an attacker-controlled OAuth application, effectively granting the threat actor access to the victim’s account without requiring them to bypass any further MFA challenges.
The implications of this are far-reaching, as the attacker gains access to all of the user’s resources and connected SSO applications. This can include a broad spectrum of services beyond Microsoft 365, such as Salesforce, Google Workspace, Dropbox, Adobe, SAP, Slack, Zendesk, Atlassian, and many others, creating a significant ripple effect of potential compromise.
Establishing Persistence and Enumerating the Cloud Environment
In a third documented attack, threat actors utilized previously compromised credentials for an account where an authenticator application was believed to have been registered days earlier. Following initial access, attackers often establish persistence by adding an MFA method that they control. Microsoft has observed threat actors registering new phone numbers, authenticator applications, and software-based one-time password tokens with compromised identities. This tactic allows them to satisfy future MFA challenges without the victim’s knowledge or intervention. However, Microsoft notes that this persistence mechanism does not survive a complete credential and session reset.
Once persistence is established, attackers frequently employ Microsoft Graph to enumerate the victim’s cloud environment. Microsoft has identified Graph requests such as /users, /groups, or /sites as common in enterprise settings, which can often blend in with legitimate administrative activity. However, the activity becomes highly suspicious when the same account, application, or access token rapidly moves across different resources, checks privileges and authentication settings, and then begins accessing sensitive data like emails, attachments, files, or documents.
Data Exfiltration: A Stealthy and Systematic Approach
Following reconnaissance, the threat actors shift their focus to cloud data collection from Microsoft 365 services. Microsoft has observed high-volume access and download activity targeting Microsoft SharePoint Online and Microsoft OneDrive for Business. In some intrusions, the attackers extended their reach into Microsoft Exchange Online, accessing email content via REST API-based methods.
Across SharePoint and OneDrive, the malicious activity generated a significant volume of FileAccessed and FileDownloaded events, indicating a systematic retrieval of cloud-hosted documents and organizational data. This data exfiltration appears to be automated, with connections often utilizing the python-httpx user agent during the access and exfiltration of data from SharePoint and OneDrive.
A key observation by Microsoft is the attackers’ deliberate avoidance of rapid "smash-and-grab" exfiltration, a tactic designed to evade immediate detection. Instead, the data theft process is prolonged, lasting from a few hours to multiple days. Threat actors meticulously control the pace of their actions, accessing fewer than 1,000 files or emails in a single hour to better blend in with legitimate user traffic and minimize the risk of triggering security alerts.
Recommendations and Mitigation Strategies
In light of these evolving threats, Microsoft offers several key recommendations for organizations to bolster their defenses. Administrators should actively monitor for unusual sign-ins, particularly those followed by new MFA registrations, suspicious Microsoft Graph reconnaissance activities, and unauthorized access to SharePoint, OneDrive, or Exchange Online.
In the event of a confirmed account compromise, immediate remediation steps are crucial. These include revoking all active sessions and tokens, resetting compromised credentials, removing any authentication methods or mailbox rules that may have been added by the attackers, and requiring the affected user to re-register their authentication methods.
Microsoft strongly advocates for the adoption of phishing-resistant MFA solutions. Furthermore, organizations should consider implementing policies that limit access to sensitive cloud resources to managed devices. Disabling device-code authentication when it is not actively needed is also a recommended preventative measure, as it removes a significant attack vector exploited by these threat groups. By understanding these tactics and implementing robust security practices, organizations can better protect their Microsoft 365 environments from these sophisticated and evolving threats.
