Author: DigitalSpying Security Desk
Date: September 14, 2026
Executive Summary
As enterprises increasingly transition toward passwordless authentication, cybercriminal syndicates have evolved their social engineering playbooks to weaponize the very security controls designed to protect users. According to threat intelligence disclosures from the Microsoft Security Research Team and threat investigations from Mandiant, threat actors—tracked under designations including UNC6671, Storm-3032, Storm-3121, and Cordial Spider—are orchestrating sophisticated passkey- and single-sign-on (SSO)-themed social engineering attacks. By impersonating corporate IT help desks over targeted voice calls (vishing) and SMS, adversaries manipulate employees into completing OAuth device-code flows or Adversary-in-the-Middle (AitM) authentications.
Once inside, threat actors do not merely steal session tokens; they immediately enroll actor-controlled Multi-Factor Authentication (MFA) methods, establishing permanent cloud persistence that survives password resets. The attackers then launch automated, high-velocity data harvesting operations across Microsoft Graph, SharePoint Online, OneDrive, and Exchange Online to exfiltrate proprietary enterprise intelligence.
Deep-Dive Technical Analysis
1. Social Engineering Pretext & Infrastructure Masquerade
The intrusion campaign demonstrates extensive reconnaissance and targeted corporate profiling:
* Pre-Attack Profiling: Threat actors gather organizational charts, employee names, mobile phone numbers, and IT vendor relationships from public sources like LinkedIn and corporate directories.
* Vishing & Passkey Lures: Attackers contact employees via phone or SMS, posing as internal IT help desk administrators. The pretext claims that the organization is mandating an urgent security update to implement passkeys, update SSO credentials, or migrate to new MFA profiles to prevent imminent account deactivation.
* Targeted Subdomain Infrastructure: The threat actors register generic identity domains (e.g., passkeyhelpdesk[.]com, setupmypasskey[.]com, syncmykey[.]com, secure-passkey[.]com) and dynamically append the victim organization's brand as a subdomain (e.g., companyname.setupmypasskey[.]com). This tailored URL is delivered via SMS or Microsoft Teams messages sent from previously compromised peer accounts.
2. The Device Code Phishing Mechanism
Rather than relying on classic credential harvesting pages that fail against robust MFA policies, adversaries abuse the OAuth 2.0 Device Authorization Grant (RFC 8628):
1. Device Code Initiation: The attacker initiates an OAuth device authorization flow against Microsoft Entra ID (Azure AD), receiving a user code and verification URI (https://microsoft.com/devicelogin).
2. Victim Redirection: The phishing landing page or vishing operator instructs the victim to navigate to the official Microsoft device login portal and input the attacker-generated code, under the guise of "registering their device for passkey support."
3. MFA Subversion: The victim authenticates using their legitimate corporate credentials and approves their existing MFA prompt on their authorized device.
4. Token Issuance to Attacker: Because the user completed authentication for the device code session, Entra ID issues primary refresh tokens (PRTs) and access tokens directly to the attacker’s client, bypassing MFA without the attacker ever touching the victim's passwords or session cookies.
3. MFA Enrollment for Persistent Access
A critical signature of this threat campaign is the immediate transformation of a transient session compromise into an unrevocable foothold:
* Secondary Factor Injection: Utilizing the freshly minted administrative or user token, the adversary accesses the user's security info registration portal (mysignins.microsoft.com).
* Registering Attacker-Controlled Authenticators: The attacker registers a secondary MFA method under their control—typically a rogue mobile phone number for SMS verification, a software-based Time-based One-Time Password (TOTP) app, or a rogue FIDO2 authenticator.
* Persistence Resilience: Even if security administrators notice anomalous sign-in geography and execute an emergency password reset or session revocation (Revoke-AzureADUserAllRefreshToken), the attacker simply authenticates anew using the victim's known username and the attacker's newly registered secondary factor.
Stage
Action Component
Security Outcome
1
Vishing/SMS Lure
Initial Contact established via Social Engineering
2
Phishing Portal
Victim enters Device Code on official MS login
3
Token Issuance
Valid OAuth Token issued directly to Threat Actor
4
Persistence
Actor registers rogue MFA at mysignins.microsoft.com
5
Exfiltration
Automated data harvesting via Microsoft Graph API
4. Automated Microsoft Graph API Reconnaissance & Data Theft
Following persistence establishment, the actors deploy automated scripts over proxy networks to execute deep enterprise espionage:
* Tenant Enumeration: Queries to Microsoft Graph API (/v1.0/users, /v1.0/groups, /v1.0/directoryRoles) map out organizational structures, administrative privilege hierarchies, and service principals.
* Bulk SharePoint & OneDrive Exfiltration: The threat actors initiate high-velocity downloads of sensitive documents, spreadsheets, engineering diagrams, and intellectual property.
* The Graph Detection Blindspot: Because each API request to Microsoft Graph uses valid OAuth tokens and standard schema parameters, individual requests do not trigger traditional signature-based web application firewalls. Only aggregated behavioral analysis tracking velocity, session origin discrepancies, and abnormal API call sequencing reveals the exfiltration.
Threat Actor Attribution: The E-Crime Convergence
Microsoft and Mandiant associate these tactics with an interconnected cybercrime ecosystem operating under extortion brands such as Helix, ShinyHunters, and Falcon:
* Storm-3032 / UNC6671: Specializes in high-touch voice phishing panels and device-code workflows, splintering from legacy groups like BlackFile.
* Storm-3121: Acts as an initial access broker, selling compromised corporate cloud sessions to ransomware and data extortion syndicates.
Actionable Recommendations & Cloud Defense Hardening
1. Disable or Restrict OAuth Device Code Flow
The Device Authorization Grant was engineered for input-constrained devices (e.g., smart TVs and CLI tools). In enterprise cloud environments, it represents a severe attack vector:
* Entra ID Conditional Access: Implement Conditional Access policies that explicitly block the Device Code Flow for standard user identities, or restrict it strictly to managed, compliant corporate devices.
2. Strengthen MFA Registration & Recovery Controls
* MFA Registration Campaign Policies: Require that users registering new authentication methods or passkeys do so only from trusted corporate network IPs or Intune-compliant managed endpoints.
* Temporary Access Pass (TAP) Governance: Ensure help desk workflows enforce rigorous out-of-band identity verification before issuing TAPs or resetting MFA profiles.
* Audit New Authentication Method Additions: Create real-time alerts in SIEM/SOAR platforms monitoring Entra ID Audit Logs for event User registered security info or User registered all security info, specifically when originating from unmanaged IP ranges.
3. Monitor Behavioral Anomalies in Microsoft Graph
* Graph Query Velocity Baseline: Establish detection analytics for sudden spikes in Microsoft Graph REST API calls originating from standard user accounts, especially requests pulling files from OneDrive or scanning SharePoint document libraries.
* Correlate Disparate Sign-In Telemetry: Integrate Entra ID Risk Events (such as "Unfamiliar sign-in properties" and "Anomalous token") with automated session revocation and immediate step-up authentication.
Sources and Reference Intelligence: The Hacker News, Microsoft Security Research, Mandiant Threat Intelligence.