Microsoft Cloud accounts stolen in highly complex impersonation and passkey phishing campaign

Date:
Mon, 14 Sep 2026 16:10:00 +0000

Description:
Passkeys have all but eliminated password theft, so what now? Criminals have
a solution.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Microsoft warns of a sophisticated campaign tricking users into updating passkeys via fake IT
calls Victims redirected to adversaryinthemiddle sites mimicking Microsoft login to steal access Attackers exfiltrate files from SharePoint, OneDrive, and Exchange; phishingresistant MFA advised Passkeys have made stealing passwords obsolete. To work around this change, hackers have started tricking users into authenticating on attacker-controlled computers. This is according to a new report from Microsoft , which says theres a highly sophisticated campaign currently taking place, with the goal of compromising peoples cloud accounts and stealing as many sensitive files as possible.

The attack starts a lot earlier than what the victim experiences. There is a lot of pre-attack planning and due diligence, in which the threat actors gather as much information about their target as possible. Knowing their
place of work, position, and personal phone number is essential. Once all the pieces are in place, the attack starts with a phone call - victims are told they are speaking to their organizations IT help desk and that they need to update their passkey (or MFA , depending on the setup) immediately, to avoid any disruptions to their operations. Latest Videos From TechRadar Watch full video here: Follow-up SMS In the follow-up to the call, the victims then receive an SMS message with a link where they can update their security configuration. On the surface, the website looks like the legitimate
Microsoft login landing page. In reality, though, this is a pre-built malicious website that uses the adversary-in-the-middle (AitM) techniques to either receive access on the actors behalf, or capture credentials.

"The actor appears to invest heavily in pre-attack research, likely gathering information about employees and organizational structure from public sources such as social networking and professional profiling platforms," Microsoft said. "In a smaller number of cases, actors take advantage of already compromised accounts to expand their reach" by sending similar passkey
-themed messages via Microsoft Teams. You may like Microsoft login pages are being abused as hackers try and lure in unlucky victims Microsoft 365 users hit by two major threat campaigns - fake IT calls and phishing emails target users across the world IT helpdesk impersonation hits Microsoft Teams once again, with the hackers hiding their activity within legitimate tools

The campaign is apparently ongoing since at least May this year, Microsoft, said, without detailing the number of victims. Its aim seems to be to exfiltrate files from SharePoint and OneDrive, as well as email data from Microsoft Exchange Online. It also did not attribute this campaign to any specific threat actor, although it did say that there are many collectives engaged in such, or similar, campaigns, including Cordial Spider, Storm-3121, and others.

Via The Hacker News Are you a pro? Subscribe to our newsletter Sign up to
the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners
or sponsors By submitting your information you agree to the Terms &
Conditions and Privacy Policy and are aged 16 or over. The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/microsoft-cloud-accounts-stolen-in-high ly-complex-impersonation-and-passkey-phishing-campaign


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)