Passkey phishing hits Microsoft 365: the call is the attack

The passkey phishing campaign Microsoft is tracking does not start with an email. It starts with a phone call to an employee's personal mobile, from someone who says they are your IT helpdesk and needs them to update a passkey before they lose access. Microsoft Threat Intelligence published the writeup on September 9 and says the activity has run since May 2026.

What actually happened

The lure is a passkey, MFA, or SSO configuration that supposedly must be updated right now. The target gets a link — often by SMS to their personal phone — to a page that looks like a Microsoft sign-in. Microsoft makes one detail explicit: despite the theme, the attackers are not trying to enroll a passkey. The passkey story is just the reason to get someone onto a fake login page in a hurry.

What happens on that page is an adversary-in-the-middle capture, or an abuse of the device-code authentication flow, to take credentials and a live session token. BleepingComputer's coverage lays out what comes next: the attacker registers authentication methods they control — their own phone number, their own authenticator app, their own TOTP token — so every future MFA prompt gets answered by them, not the victim.

Then it turns into a data job. Microsoft describes unusual sign-ins followed by new auth methods, heavy Microsoft Graph activity, SharePoint and OneDrive downloads, and mailbox collection through REST APIs. Attribution spans several extortion-linked clusters Microsoft tracks as Storm-3121 and Storm-3032, tied to ShinyHunters and Helix.

Why this matters for your business

Read the attack chain again and notice what never breaks. Not your password policy. Not your MFA rollout. A person answered a phone and did what they were told. The identity layer worked exactly as designed for whoever held the session token.

This lands hardest on companies with no real helpdesk. If your "IT department" is one contractor, a shared inbox, or the ops manager who is good with computers, then nobody on staff has a reliable picture of how a legitimate IT request reaches them. That ambiguity is the vulnerability. The attacker is not defeating a control — they are filling a gap in a process you never wrote down.

Four things worth doing this week. Publish one channel for IT requests and tell everyone that a call to their personal cell is never it. Turn off device-code flow in Entra ID unless something specific needs it; most small tenants do not. Alert on new MFA method registration — that single event is the pivot point in this entire chain, and it is cheap to watch. Move to phishing-resistant MFA on the accounts that touch money and customer data first, not on everyone at once.

And run the drill once. Call someone on your team, ask them to click a link, and see what happens. That result is your actual security posture.

Sources: Microsoft Security Blog, BleepingComputer.