[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3fwngij5QjMA658xgnbeGFewiCZHv7Aw00I6i_LgVlA":3},{"article":4,"iocs":57,"watch_terms":64,"solutions":65,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"6c63d43d-c7cd-4a42-b227-74c40f3fee23","Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data","attackers-use-passkey-phishing-to-hijack-microsoft-cloud-accounts-and-exfiltrate-fa5906","Microsoft has disclosed details of two campaigns in which threat actors are abusing third-party email delivery infrastructure to blast financial fraud scam messages and using passkey-themed social engineering to breach cloud environments. The first campaign, per the tech giant, involved sending over a million scam emails between August 3 and 5, 2026, by masquerading as chief executive officers","Microsoft has detailed two distinct attack campaigns. The first involved AI-generated, CEO-impersonating emails sent to finance departments to trick them into making fraudulent ACH transfers. The second campaign uses passkey-themed social engineering to trick users into compromising their Microsoft cloud accounts, leading to data exfiltration.","Attackers use AI-generated emails and passkey phishing to hijack Microsoft cloud accounts.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fattackers-use-passkey-phishing-to.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiZ2E2hmYwxfZ25xw5iPhCHaSDENcuEyEIaha9e_rIJCf68srth31FtjIiIlnOcEiSQDDuk2Vg-dQdNLfR753ePSoDntP3BS-MGbEH2DS8Ch5ihzhpiDZZm5UIzKCbL1vNJSwSABCYst8oG6Oa-7iBWaSF6WSTEkCJBAi9YEEwAmVEdGYvu-JWZnxwEX9ni\u002Fs1600\u002Fms-outlook.jpg","2026-09-13T10:11:48+00:00","2026-09-13T12:00:10.082798+00:00",8,[17,20,22,25,27,29],{"name":18,"type":19},"Microsoft Cloud","product",{"name":21,"type":19},"ServiceNow",{"name":23,"type":24},"ACH transfers","technology",{"name":26,"type":24},"Passkey",{"name":28,"type":24},"MFA",{"name":30,"type":24},"SSO","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47,52],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":53},{"id":54,"icon":33,"name":55,"slug":56},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",[58,62],{"type":59,"value":60,"context":61},"domain","service-nowinc[.]com","Bogus domain used in CEO impersonation scam",{"type":59,"value":63,"context":61},"domainlify[.]net",[18,21],{"controls":66,"vendors":148},[67,96,125],{"slug":68,"name":69,"problem":70,"products":71},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":97,"name":98,"problem":99,"products":100},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",[101,109,117],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"red-sift","Red Sift","\u002Fvendor-logos\u002Fred-sift.png","ondmarc","Red Sift OnDMARC","https:\u002F\u002Fredsift.com\u002Fpulse-platform\u002Fondmarc","Guided DMARC deployment and monitoring, with support for BIMI and MTA-STS.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","email-fraud-defense","Proofpoint Email Fraud Defense","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-fraud-defense","DMARC deployment and monitoring with hosted SPF and DKIM services.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"valimail","Valimail","\u002Fvendor-logos\u002Fvalimail.png","valimail-enforce","Valimail Enforce","https:\u002F\u002Fwww.valimail.com\u002Fproducts\u002Fenforce\u002F","Automated DMARC enforcement with discovery of every service that sends mail as your domain.",{"slug":126,"name":127,"problem":128,"products":129},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[130,138,143],{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":139,"product_name":140,"url":141,"description":142},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":144,"product_name":145,"url":146,"description":147},"core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",[149],{"slug":81,"name":82,"logo_path":83,"roles":150},[151],"reported_by",{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":170},"passkey-phishing-and-ceo-impersonation-target-microsoft-cloud-accounts","Passkey Phishing and CEO Impersonation Target Microsoft Cloud Accounts","Attackers are exploiting user trust through two sophisticated social engineering campaigns: AI-generated CEO impersonation emails targeting finance teams for fraudulent wire transfers, and passkey-themed phishing luring users into compromising their Microsoft cloud credentials. The root issue is that employees lack the awareness to distinguish legitimate authentication requests from convincing fakes, even when modern passkey technology is referenced to appear credible. Once cloud accounts are compromised, attackers move quickly to exfiltrate sensitive data before detection. This matters because AI-enhanced phishing dramatically lowers the skill barrier for attackers while raising the believability of attacks, making human judgment alone an insufficient defense.",[157,158,159,160,161,162,163,164,165,166,167,168,169],"CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 6 – Access Control Management","CIS Control 14 – Security Awareness and Skills Training","CIS Control 17 – Incident Response Management","NIST SP 800-63B – Digital Identity Guidelines (Phishing-Resistant AAL3)","NIST AC-2 – Account Management","NIST AC-6 – Least Privilege","NIST SI-3 – Malicious Code Protection","NIST IR-6 – Incident Reporting","MITRE ATT&CK T1566 – Phishing","MITRE ATT&CK T1530 – Data from Cloud Storage","GDPR Article 32 – Security of Processing","GDPR Article 33 – Notification of Personal Data Breach",{}]