Microsoft says threat actors tied to ShinyHunters, Helix, and other extortion groups have used passkey- and single sign-on-themed lures since May 2026 to break into corporate Microsoft accounts and steal data from Microsoft 365 services. The campaign targets employees by phone, SMS, or fake Microsoft pages that pretend an auth setting needs urgent fixing.
The trick is not passkey enrollment. Microsoft says the victims are pushed into adversary-in-the-middle phishing pages or device-code sign-in flows, which can hand over live session tokens or authorize an attacker-controlled client. That leaves the attacker with durable access to email, SharePoint, OneDrive, and Microsoft Graph even after a password change.
For Microsoft 365 and Entra ID environments, the exposure sits in the account’s granted sessions and added auth methods, not just the initial login. If help-desk impersonation or device-code approvals reach your users, a single fooled account can become a persistent foothold across mail and files.
Passkey-themed phishing attacks lead to Microsoft 365 data theft
Microsoft says threat actors linked to ShinyHunters, Helix, and other extortion gangs are using passkey and single sign-on-themed social engineering attacks to compromise corporate Microsoft accounts and steal data from Microsoft 365 services.
Passkey-themed social engineering leads to identity and cloud compromise | Microsoft Security Blog
Learn how threat actors establish MFA persistence, abuse Microsoft Graph for reconnaissance, and access SharePoint, OneDrive, and email data, along with key detection and mitigation guidance.