Passkey-themed phishing attacks lead to Microsoft 365 data theft

Threat actors are exploiting user trust in passkeys and SSO by impersonating IT help desks and luring victims to adversary-in-the-middle (AiTM) phishing sites that steal both credentials and authenticated session tokens — effectively bypassing MFA entirely. The root problem is that employees lack the awareness to distinguish legitimate IT communications from sophisticated social engineering, and organizations often fail to enforce phishing-resistant authentication methods that cannot be intercepted mid-session. Session token theft is particularly dangerous because it grants attackers persistent access without needing passwords or MFA codes. This matters because groups like ShinyHunters have demonstrated they can monetize stolen Microsoft 365 access at scale, leading to data exfiltration, ransomware staging, and supply chain attacks on downstream customers and partners.