Attackers Use Fake Passkey Updates to Hijack Microsoft 365 Accounts

by Justin Erickson

Microsoft has warned about an active social engineering campaign where attackers impersonate corporate IT help desks and tell employees they need to update a passkey, multi-factor authentication (MFA), or single sign-on configuration. These attacks have been observed since May 2026 and are by threat actors connected to ShinyHunters, Helix, and other extortion and data theft gangs. The attacks are not random – threat actors actively research beforehand and gather as much information as they can about these organizations and individuals within them. Targets usually receive phone calls or text messages directing them to fake Microsoft sign-in pages – sometimes from previously compromised accounts. They use adversary-in-the-middle (AiTM) phishing sites or device-code authentication flows to steal credentials, session tokens, or authorized access to the victim’s account. After compromise, attackers add phone numbers, authenticator apps, one-time-passwords, and other MFA methods under their control to maintain access. They then use Microsoft Graph to map users, groups, permissions, resources, and other accessible content.

To stay safe from these attacks:

• Verify unexpected IT/authentication requests through the organizations official contact methods. Do not enter authentication codes, approve MFA requests, or follow passkey setup links sent through these unexpected requests.
• Monitor accounts for unusual sign-ins and activity.
• If you suspect an account has been compromised, revoke active sessions and tokens, update credentials and MFA methods, and delete any unfamiliar MFA methods that have been added.