Social Engineering Scams Exploiting Passkey Themes Target Microsoft 365 Accounts

Recent activities have uncovered a troubling trend where attackers exploit passkey themes to deceive employees into compromising their Microsoft accounts. Microsoft Security Research has been observing these social engineering tactics since May, revealing a method where attackers impersonate IT helpdesk staff to manipulate employees into believing they must update or enroll in a passkey.

The Mechanics of Deception

What you’re seeing here is a classic playbook from the social engineering handbook. Attackers identify a vulnerability not in the technology itself, but in human trust and a company’s internal processes. Once they gain an employee's trust, victims are led to phishing pages that either mimic Microsoft’s sign-in interface or redirect them to official-looking authentication flows. This method ultimately grants attackers access to cloud identities, enabling them to set up their own authentication methods and explore the victim's Microsoft 365 environment.

Jon Baker, Vice President of Threat-Informed Defense at AttackIQ, emphasizes that the passkey in this context serves as bait rather than an inherent flaw in the system. “The MFA that got bypassed was phishable,” Baker points out, underscoring that legitimate passkeys would have thwarted this type of exploitation.

How the Scams Unfold

These attacks often initiate with a phone call or personal message to an employee from someone posing as IT support. They’ll alert employees to urgent updates needed for their passkey, MFA, or SSO settings. Victims are then sent to a fake Microsoft sign-in page, where their credentials and session tokens are put at risk. Alternatively, they might be instructed to enter a device code on a legitimate Microsoft page, inadvertently authorizing the attacker’s access.

And here’s the part most people overlook: this initial phase is particularly stealthy. Attackers leave minimal evidence on company-managed endpoints, especially if workers engage with the phishing link using unsecured personal devices. Furthermore, they’ve leveraged compromised accounts to send messages on Microsoft Teams, making their requests appear credible, as if they come from familiar colleagues. This not only instills confidence in the target but also complicates the forensic analysis needed to trace the attack.

To make matters worse, the variety of tactics employed by these attackers renders detection increasingly difficult. There are cases emerging in which they utilize pre-registered credentials and MFA configurations, indicating prior unauthorized access and persistence. It's a chilling reminder that security measures, no matter how sophisticated, are only as strong as the users who must execute them correctly.

Establishing Control Over Authentications

After a victim’s identity is compromised, attackers can register new authentication methods, taking control through phone numbers and software-based one-time passwords. This level of manipulation allows them to bypass future MFA challenges effortlessly. What’s particularly disconcerting is how easily this can go unnoticed by IT departments.

Through Microsoft Graph, attackers enumerate various cloud resources and user information before transitioning into SharePoint and OneDrive to locate and extract files. Some incidents even extended into Exchange Online, which grants attackers access to emails. This is all performed in a way designed to masquerade as normal, legitimate activity. Baker notes, “The actor registers their own authenticator method, maps the tenant through Microsoft Graph, and pulls files and mail at a pace that reads like a busy employee.” The implications are extensive, as such access can lead to broader organizational vulnerabilities.

In certain highly sophisticated instances, automated tactics have been detected. Notably, the use of the “python-httpx” user agent revealed high levels of activity within SharePoint and OneDrive. By maintaining a tactical approach—limiting the number of files or emails accessed to less than a thousand per hour—attackers can blend their illicit actions into standard enterprise workflows, making detection even more challenging.

Microsoft's Response and Strategies for Prevention

Microsoft has responded to these threats by emphasizing the importance of monitoring for unusual sign-ins correlated to newly registered authentication methods. They stress vigilance against shared graph reconnaissance, alongside unusual activity across SharePoint, OneDrive, and Exchange. Strengthening security protocols, such as implementing phishing-resistant MFA through Conditional Access, is critical to safeguarding against these tactics. Moreover, they advocate for blocking device-code and authentication transfers unless there's a clearly defined business necessity.

Implications and Future Outlook

The implications here are far-reaching for organizations, especially those heavily reliant on cloud services like Microsoft 365. If you’re working in this space, understanding the dynamics of these social engineering tactics is essential. Failure to educate employees can have devastating repercussions. Employees who are unaware may fall victim to these scams, jeopardizing not just their own credentials but the entire organization’s integrity.

As attackers continue to refine their methods, organizations must remain vigilant and proactive. Raising awareness through training sessions, implementing stricter access controls, and keeping abreast of evolving phishing techniques will be indispensable. This ongoing cat-and-mouse game between security professionals and attackers shows no sign of abating, making sustained diligence and an adaptive security posture as important as any technological advancements.