Passkey-Phishing Campaigns Harvest Microsoft 365 Credentials and Session Tokens
Written by AI from the linked story. Not reviewed by an editor. How this works
Threat actors are exploiting user trust in passkeys and SSO by impersonating IT help desks and luring victims to adversary-in-the-middle (AiTM) phishing sites that steal both credentials and authenticated session tokens — effectively bypassing MFA entirely. The root problem is that employees lack the awareness to distinguish legitimate IT communications from sophisticated social engineering, and organizations often fail to enforce phishing-resistant authentication methods that cannot be intercepted mid-session. Session token theft is particularly dangerous because it grants attackers persistent access without needing passwords or MFA codes. This matters because groups like ShinyHunters have demonstrated they can monetize stolen Microsoft 365 access at scale, leading to data exfiltration, ransomware staging, and supply chain attacks on downstream customers and partners.
Tactical Insight
Immediate Actions
- Deploy phishing-resistant MFA (FIDO2 hardware keys or platform passkeys) that cryptographically bind authentication to the legitimate origin domain, neutralizing AiTM attacks.
- Enforce Conditional Access policies in Microsoft 365 that restrict logins to compliant, managed devices and flag anomalous session token reuse.
- Alert employees via a targeted security bulletin about the active passkey/SSO-themed IT help desk impersonation campaign.
Long-Term Improvements
- Establish a verified, out-of-band IT help desk contact channel (e.g., a pinned intranet page) so employees always confirm support requests through a trusted source.
- Implement continuous token-lifetime management and short-lived session tokens to limit the window of exploitation after a session is compromised.
- Conduct regular phishing simulation exercises specifically themed around SSO, passkeys, and IT impersonation scenarios to build employee muscle memory.
Detection & Response Measures
- Enable Microsoft Entra ID sign-in risk policies and monitor for impossible travel, unfamiliar device sign-ins, and suspicious OAuth token grants.
- Ingest Microsoft 365 audit logs into a SIEM and create alerts for bulk email access, mass file downloads, or forwarding rule creation following any new authentication event.
- Maintain a pre-approved incident response playbook for AiTM credential compromise that includes immediate token revocation and tenant-wide sign-out.