Author: DigitalSpying Security Desk
Date: September 13, 2026
Executive Summary
As enterprises accelerate migrations toward passwordless authentication, cybercriminal cartels are adapting their social engineering tradecraft to subvert modern identity defenses. According to an exhaustive investigation released by Microsoft Security Research and reported by The Hacker News and CyberPress, threat actors are orchestrating sophisticated "passkey-themed" social engineering campaigns. Operating under threat clusters tracked as Storm-3121, Storm-3032, and UNC6671 (associated with the ShinyHunters and Helix extortion syndicates), adversaries impersonate internal IT help desks via voice calls and SMS to coax employees into initiating rogue passkey registrations. By weaponizing Adversary-in-the-Middle (AitM) proxies and OAuth device-code authentication flows, attackers register their own secondary multi-factor authentication (MFA) methods, establish permanent persistent footholds, and abuse the Microsoft Graph API for high-volume data exfiltration across SharePoint, OneDrive, and Exchange Online.
Deep-Dive Technical Analysis
1. The Pretext & Initial Social Engineering Phase
Rather than deploying generic login portals, adversaries leverage targeted corporate recon:
* Reconnaissance & Profiling: Attackers scrape employee directories, LinkedIn profiles, and organizational charts to identify specific corporate roles and reporting hierarchies.
* Vishing & SMS Lures: The adversary contacts an employee on their personal mobile number via phone call or SMS, posing as a corporate IT support representative. The pretext claims that an urgent "passkey configuration update," "MFA synchronization," or "SSO renewal" is required immediately to prevent service disruption.
* Counterfeit Passkey Infrastructure: Victims are directed to customized credential harvesting portals hosted on lookalike domains.
Infrastructure Category
Examples of Identified Domains
General Passkey Phishing
secure-passkey[.]com
Support Simulation
passkeyhelpdesk[.]com, setupmypasskey[.]com
Targeted Portals
2. Subverting Multi-Factor Safeguards: Device Code & AitM Flows
The core innovation of this campaign is its exploitation of authentication protocols that bypass traditional password boundaries:
* Device-Code Authentication Hijack: In numerous observed intrusions, the adversary initiates a Microsoft OAuth 2.0 Device Authorization Grant (/oauth2/v2.0/devicecode). The attacker prompts the victim to enter an authorization code into a legitimate Microsoft sign-in interface under the guise of "pairing their passkey." Once the user signs in and authorizes the prompt, the attacker's remote session receives valid OAuth refresh and access tokens with full user privileges—completely bypassing MFA without ever needing to steal a password or session cookie.
* AitM Reverse-Proxying: Alternatively, the actor deploys customized Adversary-in-the-Middle reverse proxies to relay credentials and session cookies in real time, capturing authentication session state.
3. Establishing MFA Persistence & Tenant Enumeration
Once inside the tenant, the adversary's primary objective is establishing an unevictable persistent foothold:
1. Rogue Second-Factor Registration: The actor navigates directly to Microsoft Entra ID (Azure AD) security info management (mysignins.microsoft.com) and enrolls a new phone number, software OTP authenticator app, or rogue hardware token under attacker control. This decouples their access from the compromised user's personal devices.
2. Abuse of the Microsoft Graph API: The adversary utilizes automated Python and PowerShell scripts to query the Microsoft Graph API (https://graph.microsoft.com/v1.0/):
* Directory Reconnaissance: Enumerating all tenant users, security groups, assigned administrative roles, and enterprise applications.
* Mailbox Harvesting: Programmatically dumping inbox messages, sent items, and attachment metadata via REST endpoints.
* Bulk File Exfiltration: Executing sustained, automated downloads across SharePoint Online document libraries and OneDrive for Business, extracting confidential spreadsheets, intellectual property, and financial records over multi-day windows.
3. Infrastructure Rotation: To evade behavioral detection, attackers deliberately segregate IP infrastructure—utilizing residential proxies for initial sign-in, separate cloud IP addresses for Graph API enumeration, and dedicated bulletproof VPS nodes for data exfiltration.
Industry Impact & Enterprise Cloud Identity Assessment
This campaign exposes systemic vulnerabilities in modern enterprise identity lifecycles:
* The Psychological Blind Spot of "Passkeys": Because passkeys are widely promoted as unphishable, employees believe that any interaction mentioning "passkeys" or "FIDO security keys" is inherently safe, making them highly susceptible to IT helpdesk impostors.
* Limitations of Single-Event SIEM Detections: As Microsoft notes, individual Graph API calls appear completely benign when viewed in isolation. Traditional Security Operations Centers (SOCs) fail to detect intrusions when legitimate API endpoints are queried without anomalous syntax errors.
* Syndicate Convergence with Financial Fraud: Concurrently, operators launched high-volume financial scams—blasting over 1 million AI-generated phishing emails impersonating CEOs to trick accounts payable teams into making fraudulent Automated Clearing House (ACH) transfers for bogus ServiceNow renewals.
Actionable Recommendations & Cloud Defense Protocols
1. Restrict and Audit OAuth Device-Code Flows
* Disable Device Code Flow for Workstations: Unless required by headless IoT devices, block the Device Authorization Grant flow tenant-wide using Microsoft Entra Conditional Access policies.
* Alert on Device-Code Token Grants: Configure SIEM/EDR alerts on sign-in logs where the authentication protocol is flagged as Device Code (sign-in event 50199 or application ID 04b07795-8ddb-461a-bbee-02f9e1bf7b46).
2. Enforce Strict Self-Service MFA Registration Controls
* Require Verified Network or TAP for MFA Registration: Configure Conditional Access rules requiring users to be on a trusted corporate network or require a Temporary Access Pass (TAP) issued by an authorized admin before registering new MFA methods or passkeys.
* Real-Time Alerts on Secondary Factor Additions: Deploy automated webhook notifications alerting users and SOC analysts whenever a new authenticator app, phone number, or passkey is added to an account.
3. Behavioral Graph API Auditing & Egress Throttling
* Monitor High-Volume REST Exfiltration: Establish anomalous activity baselines for Microsoft Graph API requests, specifically flagging unusual surges in DriveItem downloads, mailbox searches, or bulk user directory exports.
* Implement Conditional Access Session Lifetimes: Enforce Continuous Access Evaluation (CAE) and strict session revocation policies that terminate all active sessions and refresh tokens upon detection of high-risk sign-in anomalies.
Sources and Reference Intelligence: The Hacker News, CyberPress, Microsoft Security Threat Intelligence.