The latest Microsoft security research highlights a growing threat: attackers are using passkey-themed scams to trick employees into granting access to Microsoft 365 environments. This campaign is particularly relevant to schools, local governments, and businesses that rely on Microsoft 365 for daily operations. The key lesson is simple: passkeys themselves are not being compromised. Instead, attackers are exploiting people through carefully crafted social engineering attacks. [microsoft.com], [csoonline.com]
Why This Matters
Organizations have been encouraged to adopt stronger authentication methods such as passkeys because they are designed to resist phishing attacks. Microsoft and CISA both identify phishing-resistant authentication as one of the strongest defenses against account compromise. [learn.microsoft.com], [cisa.gov]
Unfortunately, cybercriminals have adapted.
According to Microsoft Security Research, attackers are impersonating internal IT help desk staff and contacting employees through phone calls, text messages, and even Microsoft Teams messages. They create a sense of urgency, claiming that users need to update a passkey, MFA setting, or single sign-on configuration immediately. Victims are then directed to phishing sites or convinced to complete device-code authentication processes that ultimately grant access to the attacker’s systems. [microsoft.com], [csoonline.com]
The result can be significant. Microsoft observed threat actors gaining access to Microsoft 365 environments, registering their own authentication methods, conducting reconnaissance through Microsoft Graph, and accessing cloud-hosted emails, SharePoint files, and OneDrive data. [microsoft.com], [csoonline.com]
Understanding the Attack
The Attack Starts with Trust
Unlike traditional phishing emails, this campaign often begins with a direct phone call or text message to an employee’s personal device. Attackers pose as members of the organization’s IT department and use language that sounds legitimate. [microsoft.com], [csoonline.com]
Common themes include:
- “Your passkey needs to be updated.”
- “Your MFA settings are about to expire.”
- “Your single sign-on account requires immediate attention.”
- “Your access will be disabled unless you complete this process.” [microsoft.com], [csoonline.com]
Passkeys Are the Lure, Not the Vulnerability
One of the most important takeaways from Microsoft’s investigation is that the attackers are not exploiting weaknesses in passkey technology itself.
Microsoft researchers specifically note that the passkey narrative is being used as a convincing pretext to guide victims into adversary-in-the-middle (AiTM) phishing attacks or device-code authentication flows. In many cases, actual passkey enrollment is not the attacker’s objective. [microsoft.com], [csoonline.com]
This is an important distinction. Passkeys remain one of the strongest authentication methods available because they use cryptographic verification tied to legitimate websites and services. [learn.microsoft.com], [microsoft.com]
Why User Education Matters More Than Ever
Technical controls are critical, but this campaign demonstrates that attackers continue targeting the human element.
Employees who receive unexpected requests involving authentication should be trained to slow down, verify requests through known internal channels, and avoid using links or phone numbers provided by the caller. Organizations that regularly conduct security awareness training are often better positioned to identify and stop these types of attacks before they become incidents. [microsoft.com], [cisa.gov]
Five Ways IT Administrators Can Protect Their Microsoft Environments
1. Deploy Phishing-Resistant Authentication
Microsoft and CISA both recommend moving toward phishing-resistant MFA technologies whenever possible. These include passkeys, FIDO2 security keys, Windows Hello for Business, and other authentication methods that are resistant to traditional phishing attacks. [learn.microsoft.com], [cisa.gov]
The goal is to reduce dependence on authentication methods that can be socially engineered or intercepted.
2. Train Staff to Verify All Help Desk Requests
Employees should be taught that legitimate IT staff will never be offended by verification.
If someone receives an unexpected call, text, or Teams message requesting credential changes, MFA updates, or passkey enrollment, they should independently contact the IT department using known contact information before taking any action. [microsoft.com], [cisa.gov]
3. Monitor Authentication Method Changes
Microsoft observed attackers registering their own phone numbers, authenticator apps, and OTP tokens after gaining account access. Monitoring for newly registered authentication methods can help identify compromised accounts before significant damage occurs. [microsoft.com], [csoonline.com]
4. Implement Strong Conditional Access Policies
Conditional Access policies can help restrict risky authentication scenarios by requiring approved devices, enforcing stronger authentication methods, and limiting access from suspicious locations or sessions. Microsoft recommends using these controls as part of a broader phishing-resistant authentication strategy. [learn.microsoft.com], [learn.microsoft.com]
5. Regularly Review Identity and Access Controls
Organizations should routinely review privileged accounts, authentication methods, guest users, and sign-in activity. Regular identity hygiene reduces opportunities for attackers to establish long-term persistence following a successful compromise. [microsoft.com], [learn.microsoft.com]
Key Takeaways
- Passkeys were not broken in this campaign. Attackers used passkeys as a social engineering lure. [microsoft.com], [csoonline.com]
- The attacks often begin with phone calls, text messages, or Teams chats impersonating IT support. [microsoft.com], [csoonline.com]
- Successful compromises can lead to unauthorized access to Microsoft 365 data, including SharePoint, OneDrive, and Exchange Online resources. [microsoft.com], [csoonline.com]
- User awareness remains one of the most effective defenses against social engineering attacks. [cisa.gov], [microsoft.com]
- Organizations should continue adopting phishing-resistant authentication methods while strengthening their overall identity security strategy. [learn.microsoft.com], [cisa.gov]
Common Questions and Misconceptions
Are passkeys insecure?
No. Microsoft’s research indicates that attackers are using passkeys as a pretext for social engineering. The attacks target users rather than exploiting flaws in passkey technology. [microsoft.com], [learn.microsoft.com]
If we use MFA, are we protected?
MFA remains important, but some forms of MFA are more resistant to phishing than others. Microsoft and CISA recommend phishing-resistant MFA methods whenever possible. [learn.microsoft.com], [cisa.gov]
Why are attackers targeting personal phones?
Microsoft notes that initial contact often occurs on unmanaged personal devices, which can leave less evidence for security teams and may bypass enterprise security tools. [microsoft.com], [csoonline.com]
Can attackers maintain access after passwords are changed?
In some cases, attackers may register their own authentication methods after gaining access. Organizations should investigate and remove unauthorized authentication methods during incident response. [microsoft.com], [csoonline.com]
How Twotrees Can Help
Identity security has become one of the most important aspects of modern cybersecurity. As organizations adopt Microsoft 365, Microsoft Entra ID, and passwordless authentication technologies, they also need policies, user education, and security controls that support those investments.
Twotrees Technologies helps schools, local governments, utilities, and businesses evaluate their identity security posture, implement Microsoft security best practices, strengthen authentication controls, and educate users on how to recognize modern social engineering attacks. The goal is not simply deploying new technology, but ensuring people understand how attackers attempt to exploit trust and urgency to bypass security controls.
By combining strong authentication strategies with practical security awareness training and ongoing security reviews, organizations can significantly reduce their risk from identity-focused attacks like this one.
References
- Microsoft Security Blog: Passkey-themed social engineering leads to identity and cloud compromise
https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/ [microsoft.com] - Microsoft Learn: Phishing-resistant MFA
https://learn.microsoft.com/en-us/security/zero-trust/sfi/phishing-resistant-mfa [learn.microsoft.com] - Microsoft Learn: Plan a phishing-resistant passwordless authentication deployment in Microsoft Entra ID
https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-deploy-phishing-resistant-passwordless-authentication [learn.microsoft.com] - CISA: Implementing Phishing-Resistant MFA
https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf [cisa.gov] - CSO Online: Attackers use passkey-themed scams to hijack Microsoft 365 accounts
https://www.csoonline.com/article/4221110/attackers-use-passkey-themed-scams-to-hijack-microsoft-365-accounts.html [csoonline.com]
Related Twotrees Links
- From Password Sprawl to Single Sign-On: A Practical Identity Strategy
https://bytes.twotrees.com/category/cyber-security/ [bytes.twotrees.com] - Streamlining K-12 School IT with Microsoft Azure Entra ID: A Game-Changer for Identity Management
https://bytes.twotrees.com/category/microsoft/azure/ [bytes.twotrees.com] - Enhancing K-12 School Network Security and Management with Azure Entra
https://bytes.twotrees.com/category/microsoft/azure/ [bytes.twotrees.com] - Protecting Against Fraudulent Emergency Data Requests: A Critical Warning for Schools and Small Businesses
https://bytes.twotrees.com/protecting-against-fraudulent-emergency-data-requests-a-critical-warning-for-schools-and-small-businesses/ [bytes.twotrees.com]
