Reported by 1 outlet

Timeline

1. original reporting

   Passkey-themed phishing attacks lead to Microsoft 365 data theft https:// bleepingcomputer.com/news/security/ passkey-themed-phishing-attack

   www.bleepingcomputer.com · 32d ago · September 11th, 2026

   Passkey-themed phishing attacks lead to Microsoft 365 data theft https:// bleepingcomputer.com/news/security/ passkey-themed-phishing-attack

   via X https://www.bleepingcomputer.com/news/security/passkey-themed-phishing-attacks-lead-to-microsoft-365-data-theft/

2. update from bleepingcomputer.com

   Passkey-themed phishing attacks lead to Microsoft 365 data theft

   bleepingcomputer.com · 32d ago · September 11th, 2026

   Microsoft says threat actors linked to ShinyHunters, Helix, and other extortion gangs are using passkey and single sign-on-themed social engineering attacks to compromise corporate Microsoft accounts and steal data from Microsoft 365 services. The activity has been observed since May 2026 and begins with the attackers researching targeted organizations and employees before calling or messaging victims while impersonating corporate IT help desks. The attackers tell employees that they must urgently update a passkey, multi-factor authentication (MFA), or single sign-on (SSO) configuration to avoid losing access to corporate systems. Victims are then directed to phishing sites designed to resemble legitimate Microsoft login pages, with links sometimes sent through SMS messages to employees' personal phones. Microsoft says that while the lures frequently revolve around passkeys, the attackers are not attempting to enroll a passkey. Instead, the passkey lures are used to trick targeted employees into signing in to adversary-in-the-middle (AiTM) phishing sites or using device-code authentication flows . AiTM attacks allow the threat actors to capture credentials and session tokens. Device code phishing tricks victims into authorizing access to their account via an attacker-controlled client using Microsoft's legitimate authentication pages. Microsoft says the attackers conduct extensive research before targeting employees. "The actor appears to invest heavily in pre-attack research

3. mentioned by www.bleepingcomputer.com

   Passkey-themed phishing attacks lead to Microsoft 365 data theft Indicators extracted from public reporting. Source: https://www. bleepingco

   www.bleepingcomputer.com · 32d ago · September 11th, 2026

4. update from www.bleepingcomputer.com

   Reward: You've received the honorary title of Passkey Paladin — Guardian of a Door That Is Already Open. https://www. bleepingcomputer.com/n

   www.bleepingcomputer.com · 30d ago · September 13th, 2026

   Reward: You've received the honorary title of Passkey Paladin — Guardian of a Door That Is Already Open.