Reported by 5 outlets

Timeline

1. original reporting

   Passkey Phishing Hijacks Microsoft 365 Accounts for Cloud Data Theft

   cyberpress.org · 33d ago · September 10th, 2026

   The activity, observed since May 2026, relies heavily on social engineering. Victims may receive a phone call, SMS message, or Microsoft Teams message from someone impersonating the organization’s IT helpdesk. The attacker claims that the user must urgently update a passkey, multifactor authentication (MFA), or SSO setting to avoid losing access. The victim is then directed to a fake Microsoft sign-in page. In many cases, the passkey message is only a lure. The real goal is to capture credentials and session tokens through adversary-in-the-middle (AiTM) phishing, or to trick the victim into approving a device-code authentication request on a legitimate Microsoft page. This can give the attacker access without directly stealing a browser cookie. paste.txt Passkey Phishing Hijacks Microsoft 365 After gaining access, the attackers move quickly to make the compromise persistent. They register an authentication method under their control, such as a new phone number, Microsoft Authenticator device , or software-based one-time password token. This added MFA method allows the threat actor to satisfy later authentication prompts without involving the victim. Microsoft noted that attackers may use stolen tokens and unrevoked sessions alongside these newly added authentication methods to maintain access. One investigated sequence began with an unusual sign-in to Microsoft OfficeHome from an unmanaged device. Observed attack sequence showing identity compromise through social engineering

2. update from cybersecuritynews.com

   Hackers Use Passkey-Themed Phishing to Hijack Microsoft 365 Accounts and Steal Cloud Data Indicators extracted from public reporting. Source

   cybersecuritynews.com · 33d ago · September 10th, 2026

   Hackers Use Passkey-Themed Phishing to Hijack Microsoft 365 Accounts and Steal Cloud Data Indicators extracted from public reporting. Source

   via Mastodon https://cybersecuritynews.com/passkey-themed-phishing/

3. update from zubiqo.com

   Attackers are weaponizing fake passkey alerts to bypass MFA and hijack Microsoft cloud environments. Hackers are tricking employees via SMS

   zubiqo.com · 30d ago · September 13th, 2026

   Attackers are weaponizing fake passkey alerts to bypass MFA and hijack Microsoft cloud environments. Hackers are tricking employees via SMS

   via Mastodon https://zubiqo.com/news/passkey-phishing-explodes-hackers-weaponize-ai-to-hijack-microsoft-cloud-accounts-juj5e0

4. update from threat-intelligence.redeyesecurity.com

   Microsoft: attackers are social-engineering help desks into enrolling passkeys they control, hijacking cloud accounts and draining SharePoin

   threat-intelligence.redeyesecurity.com · 30d ago · September 13th, 2026

   Microsoft: attackers are social-engineering help desks into enrolling passkeys they control, hijacking cloud accounts and draining SharePoin

   via Mastodon https://threat-intelligence.redeyesecurity.com/blog/passkey-phishing-microsoft-cloud-hijack-storm-3032-2026

5. update from www.microsoft.com

   :microsoft: Attackers use Passkey Phishing to Hijack Microsoft Cloud Accounts and exfiltrate Data. Microsoft has disclosed details of two ca

   www.microsoft.com · 26d ago · September 17th, 2026

   Microsoft has disclosed details of two ca

   via Mastodon https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/