Microsoft Security Research has published details of active cloud intrusions in which attackers use passkey, multifactor authentication (MFA) and single sign-on (SSO) update requests as social-engineering lures. The report is important for a precise reason: it does not describe a break in passkey cryptography. Microsoft says the passkey theme is a pretext that guides a victim into an adversary-in-the-middle (AiTM) phishing flow or a device-code authorization flow.

The activity has been observed since May 2026, according to Microsoft. Its reported sequence begins with a caller or message impersonating an IT helpdesk, then moves from identity compromise to attacker-controlled authentication-method enrollment, Microsoft Graph reconnaissance and collection from Microsoft 365 workloads. Independent reporting by BleepingComputer and CSO Online describes the same Microsoft research and its defender guidance.

The lure is not the weakness

In the AiTM path, a look-alike sign-in site can capture credentials and session tokens. In a device-code path, the victim is persuaded to authorize an attacker-controlled client through a legitimate authentication page. Both routes exploit a user-facing authorization decision; neither makes a genuine passkey itself phishable.

Microsoft says the initial interaction may leave limited endpoint evidence, especially when a victim opens a link on a personal device outside endpoint management. That makes the next stages more valuable for detection: unusual sign-ins, newly registered authentication methods, token activity and rapid movement into cloud services can form a connected investigation trail.

What Microsoft observed after access

Microsoft reports that actors used compromised identities to add authentication methods under their control, including phone numbers, authenticator applications and software-based one-time-password tokens. That persistence can let an actor satisfy later MFA challenges. The company also observed Microsoft Graph activity to enumerate users, groups, roles, applications, permissions and cloud resources.

Collection then extended to SharePoint Online and OneDrive for Business, with some intrusions involving Exchange Online email through REST API access. Microsoft says the activity could be sustained over hours or days, and that fewer than 1,000 files or emails were often accessed in an hour. That measured pace is a reason to correlate identity, Graph and workload telemetry instead of relying on a single high-volume threshold.

Recommendations

  1. Investigate the full sequence. Prioritize unusual or risky sign-ins followed by new authentication-method or device enrollment, Microsoft Graph reconnaissance, token issuance and abnormal SharePoint, OneDrive or Exchange activity.
  2. Review new authentication methods. Validate newly registered methods with the account owner and remove unauthorized ones. For a confirmed compromise, revoke active sessions and tokens, reset credentials and require authentication-method re-registration, as Microsoft recommends.
  3. Control high-risk authorization paths. Review device-code authentication and authentication-transfer flows; disable or restrict them where they have no documented business need. Apply Conditional Access to limit access to sensitive cloud resources from unmanaged devices where appropriate.
  4. Prepare helpdesk and users for the pretext. Make clear that support staff should not direct employees to sign in through an unsolicited link, enter a device code supplied by a caller or approve an unexpected authentication request. Give users a known, independently reachable support channel for verification.
  5. Hunt across cloud workloads. Preserve and correlate Entra sign-in and audit logs with Microsoft Graph, SharePoint, OneDrive and Exchange signals. A new MFA method paired with privilege discovery and file or mailbox access deserves urgent investigation.

A useful framing for incident response

Calling these incidents “passkey attacks” risks teaching the wrong lesson. The reported problem is social engineering that converts a familiar identity-security change into an authorization or session-theft opportunity. Phishing-resistant authentication remains valuable, but identity teams also need controls and detection for device-code consent, unmanaged-device access, post-compromise MFA changes and cloud collection. The durable signal is the chain: compromise, persistence, discovery and data access.