[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOJ52LyGHA5FS1_XFMXJBdyUgf0phlbTkIQU0pwFPRpo":3},{"article":4,"iocs":49,"watch_terms":50,"solutions":51,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"0fe0e6b2-f8a9-4902-93a8-e15757ae6a75","Passkey-themed social engineering leads to identity and cloud compromise","passkey-themed-social-engineering-leads-to-identity-and-cloud-compromise-7f0d09","Passkey-themed social engineering is being used to compromise identities and enable broader cloud attacks. Learn how threat actors establish MFA persistence, abuse Microsoft Graph for reconnaissance, and access SharePoint, OneDrive, and email data, along with key detection and mitigation guidance. The post Passkey-themed social engineering leads to identity and cloud compromise appeared first on Microsoft Security Blog.","Threat actors are using passkey-themed social engineering to compromise cloud identities, gain MFA persistence, and conduct reconnaissance using Microsoft Graph. The attacks involve luring victims with fake IT helpdesk calls or messages to phishing sites that capture credentials and session tokens, leading to unauthorized access to SharePoint, OneDrive, and email data. The activity has been observed since May 2026, utilizing proxy-associated infrastructure for automated data collection.","Passkey-themed social engineering is used to compromise identities and enable cloud attacks.","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F09\u002F09\u002Fpasskey-themed-social-engineering-leads-identity-cloud-compromise\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Fwp-content\u002Fuploads\u002F2026\u002F04\u002FMS_Actional-Insights_Rapid-response.jpg","2026-09-09T17:41:18+00:00","2026-09-09T20:00:17.011757+00:00",8,[17,20,22,24,26,29],{"name":18,"type":19},"Microsoft Graph","product",{"name":21,"type":19},"SharePoint",{"name":23,"type":19},"OneDrive",{"name":25,"type":19},"Microsoft Defender for Endpoint",{"name":27,"type":28},"MFA","technology",{"name":30,"type":28},"SSO","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},[],[18,21,23],{"controls":52,"vendors":137},[53,82,108],{"slug":54,"name":55,"problem":56,"products":57},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":83,"name":84,"problem":85,"products":86},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[87,92,100],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":88,"product_name":89,"url":90,"description":91},"identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":109,"name":110,"problem":111,"products":112},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[113,121,129],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",[138],{"slug":130,"name":131,"logo_path":132,"roles":139},[140,141],"reported_by","affected",{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":162},"passkey-themed-phishing-hijacks-cloud-identities-and-mfa-sessions","Passkey-Themed Phishing Hijacks Cloud Identities and MFA Sessions","Threat actors are exploiting user trust in passkey technology by impersonating IT helpdesk staff and directing victims to phishing sites that harvest both credentials and live session tokens, effectively bypassing MFA protections. Once inside, attackers establish persistent MFA footholds and use Microsoft Graph APIs to silently conduct reconnaissance and exfiltrate data from SharePoint, OneDrive, and email. This attack chain is particularly dangerous because it targets the human element rather than technical vulnerabilities, meaning even well-patched environments remain exposed. The abuse of legitimate cloud APIs like Microsoft Graph for data collection makes detection harder, as malicious activity blends with normal usage patterns. Organizations that rely solely on MFA as a security guarantee without layered detection and user education are especially vulnerable.",[147,148,149,150,151,152,153,154,155,156,157,158,159,160,161],"CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 6 – Access Control Management","CIS Control 14 – Security Awareness and Skills Training","CIS Control 17 – Incident Response Management","NIST SP 800-63B – Digital Identity Guidelines (Phishing-Resistant AAL3)","NIST AC-2 – Account Management","NIST AC-17 – Remote Access","NIST SI-4 – System Monitoring","NIST IA-5 – Authenticator Management","MITRE ATT&CK T1566 – Phishing","MITRE ATT&CK T1539 – Steal Web Session Cookie","MITRE ATT&CK T1078 – Valid Accounts","MITRE ATT&CK T1530 – Data from Cloud Storage","GDPR Article 32 – Security of Processing","GDPR Article 33 – Notification of a Personal Data Breach",{}]