- Published on
Microsoft reveals phishing attacks targeting corporate employees with fake 'Passkey update' to steal Microsoft 365 cl...
- Authors
- Name
- DeepHorus
On September 12, Microsoft released a security report disclosing that hacker groups are using "update Passkey" as a lure to launch phishing attacks against enterprise employees, aiming to compromise Microsoft 365 accounts and steal cloud data. The report shows that groups such as ShinyHunters and Helix are involved. The attacks have been observed since May 2026.
Attackers first investigate target enterprises and employees. They then impersonate IT support and, via phone or messages, urge employees to urgently update Passkey, multi-factor authentication, or single sign-on configurations. After gaining trust, they guide victims to an adversary-in-the-middle (AiTM) phishing site disguised as the official Microsoft login page, intercepting credentials and session tokens.
Microsoft disclosed that in one intrusion, an unmanaged device logged into Microsoft 365 services. After completing MFA verification, the attacker established a session and within minutes accessed pages such as My Apps and My Profile, then expanded to SharePoint Online, Outlook Web, and internal enterprise applications. The session lasted about one hour, during which the attacker continuously enumerated sensitive files and internal applications.
In another attack, the attacker induced the victim to enter a device code provided by the attacker on an official Microsoft authentication page. This allowed the attacker-controlled OAuth application to obtain an authentication token and access the account without triggering MFA again. Other attacks used previously leaked credentials to conduct reconnaissance through automated Node.js systems and the Microsoft Graph API.
Attackers add MFA verification methods controlled by themselves to victim accounts to achieve persistence. They then use Microsoft Graph to enumerate the enterprise cloud environment, including organizations, users, directory roles, OAuth permissions, and SharePoint sites, and read emails. Some attacks performed high-frequency downloads from SharePoint and OneDrive, and even accessed Exchange Online emails via REST APIs.
Microsoft noted that hackers keep the number of files or emails accessed per hour below 1,000 to reduce anomaly detection. It recommends that enterprises monitor abnormal logins, new MFA registrations, and Microsoft Graph reconnaissance activities; after confirming an intrusion, immediately revoke sessions, reset credentials, and remove verification methods added by attackers. Also, adopt phishing-resistant MFA, restrict sensitive resources to be accessible only from managed devices, and disable unnecessary device code verification features.
