How are attackers bypassing passkeys in Microsoft cloud accounts?
Passkeys are designed to replace traditional passwords and reduce risks related to credential theft. However, attackers have adapted by employing highly sophisticated social engineering and technical tactics to trick users directly. Instead of stealing passwords, these campaigns manipulate victims into authenticating on attacker-controlled platforms through impersonation and adversary-in-the-middle (AitM) websites that mimic genuine Microsoft login pages.
The attack typically begins after extensive reconnaissance, where threat actors collect personal and organizational details from social media and professional networks. They use this information to convincingly impersonate an organization's IT help desk, initiating contact via phone calls to persuade targets that passkey or multi-factor authentication (MFA) updates are urgent.
What techniques do attackers use to steal access and data?
Following the initial call, victims receive an SMS containing a link to a deceptive website crafted to look like a legitimate Microsoft login page. This site operates as an adversary-in-the-middle, intercepting authentication data or relaying real-time access tokens back to the attacker. In some cases, attackers expand their reach by sending similar phishing messages through compromised accounts on platforms like Microsoft Teams.
The ultimate goal of these campaigns is to infiltrate cloud services such as SharePoint, OneDrive, and Microsoft Exchange Online, allowing attackers to exfiltrate sensitive files and emails. This approach demonstrates a shift in tactics from password theft to direct user manipulation combined with advanced interception methods.
What can Microsoft cloud users do to protect themselves effectively?
Since traditional reliance on passkeys and MFA can be undermined by these social engineering and AitM techniques, users and organizations should implement additional layers of defense. Employing phishing-resistant MFA methods, such as hardware security keys that support protocols like FIDO2, can significantly reduce risk.
Organizations should also invest in user education to recognize impersonation attempts, verify unexpected requests through independent channels, and ensure IT communication is easily distinguishable from external contacts. Monitoring and restricting account permissions, alongside prompt incident response procedures, can mitigate potential damage from successful breaches.
Key takeaway: Strengthen defenses beyond passkeys with vigilance and phishing-resistant methods
The emergence of sophisticated passkey phishing campaigns targeting Microsoft cloud accounts highlights that no single security measure is foolproof. Users must be vigilant about unsolicited IT support requests and carefully verify authentication prompts.
Adopting phishing-resistant MFA solutions and fostering awareness around advanced social engineering tactics provide practical steps to protect sensitive cloud data against evolving threats. Combining technical safeguards with informed behavior is essential to maintaining account security in this challenging landscape.