[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXCOu6rD_X5RIP1GjIXRvrjct30vFOaTYJ2VKb--1hFU":3},{"article":4,"iocs":54,"watch_terms":73,"solutions":74,"lesson":165},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"ac0b574c-a787-47f0-8df2-ba72fee57ebe","Passkey-themed phishing attacks lead to Microsoft 365 data theft","passkey-themed-phishing-attacks-lead-to-microsoft-365-data-theft-82dfd2","Microsoft says threat actors linked to ShinyHunters, Helix, and other extortion gangs are using passkey and single sign-on-themed social engineering attacks to compromise corporate Microsoft accounts and steal data from Microsoft 365 services. [...]","Threat actors, including groups linked to ShinyHunters and Helix, are using social engineering tactics themed around passkeys and single sign-on to compromise Microsoft 365 accounts. These attacks involve impersonating IT help desks to direct victims to phishing sites that capture credentials and session tokens via adversary-in-the-middle (AiTM) or device-code authentication flows. The attackers conduct extensive pre-attack research and register convincing phishing domains.","Passkey-themed phishing attacks target Microsoft 365 accounts, leading to data theft.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fpasskey-themed-phishing-attacks-lead-to-microsoft-365-data-theft\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2025\u002F08\u002F04\u002FMicrosoft-365.jpg","2026-09-11T17:26:50+00:00","2026-09-11T18:00:38.517581+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"ShinyHunters","threat_actor",{"name":24,"type":22},"Helix",{"name":26,"type":22},"Storm-3121",{"name":28,"type":22},"Storm-3032",{"name":30,"type":22},"UNC6671","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47,52],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":53},{"id":31,"icon":33,"name":34,"slug":35},[55,59,61,63,65,67,69,71],{"type":56,"value":57,"context":58},"domain","passkeyhelpdesk[.]com","Phishing domain used in passkey-themed attacks",{"type":56,"value":60,"context":58},"secure-passkey[.]com",{"type":56,"value":62,"context":58},"setupmypasskey[.]com",{"type":56,"value":64,"context":58},"add-passkey[.]com",{"type":56,"value":66,"context":58},"integratedsso[.]com",{"type":56,"value":68,"context":58},"oktasession[.]com",{"type":56,"value":70,"context":58},"keysyncos[.]com",{"type":56,"value":72,"context":58},"oskeysync[.]com",[18],{"controls":75,"vendors":160},[76,104,133],{"slug":77,"name":78,"problem":79,"products":80},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":98,"vendor_name":18,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":105,"name":106,"problem":107,"products":108},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[109,117,125],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"slug":134,"name":135,"problem":136,"products":137},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[138,146,153],{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":134,"product_name":150,"url":151,"description":152},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":154,"vendor_name":155,"vendor_logo":156,"product_slug":154,"product_name":157,"url":158,"description":159},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[161],{"slug":98,"name":18,"logo_path":99,"roles":162},[163,164],"reported_by","affected",{"slug":166,"title":167,"body":168,"framework_refs":169,"framework_notes":184},"passkey-phishing-campaigns-harvest-microsoft-365-credentials-and-session-tokens","Passkey-Phishing Campaigns Harvest Microsoft 365 Credentials and Session Tokens","Threat actors are exploiting user trust in passkeys and SSO by impersonating IT help desks and luring victims to adversary-in-the-middle (AiTM) phishing sites that steal both credentials and authenticated session tokens — effectively bypassing MFA entirely. The root problem is that employees lack the awareness to distinguish legitimate IT communications from sophisticated social engineering, and organizations often fail to enforce phishing-resistant authentication methods that cannot be intercepted mid-session. Session token theft is particularly dangerous because it grants attackers persistent access without needing passwords or MFA codes. This matters because groups like ShinyHunters have demonstrated they can monetize stolen Microsoft 365 access at scale, leading to data exfiltration, ransomware staging, and supply chain attacks on downstream customers and partners.",[170,171,172,173,174,175,176,177,178,179,180,181,182,183],"CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 6: Access Control Management","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIST SP 800-63B: Digital Identity Guidelines — Phishing-Resistant AAL3 Authenticators","NIST AC-2: Account Management","NIST AC-17: Remote Access","NIST SI-3: Malicious Code Protection","NIST IR-4: Incident Handling","MITRE ATT&CK T1111: MFA Interception","MITRE ATT&CK T1539: Steal Web Session Cookie","MITRE ATT&CK T1566.002: Spearphishing Link","GDPR Article 32: Security of Processing (for EU data involved in breaches)","Microsoft Zero Trust Principle: Verify Explicitly — Enforce device compliance and sign-in risk evaluation",{}]