Passkey Phishing Lures Fuel Major Microsoft 365 Data Theft

Executive Summary

Threat actors affiliated with premier extortion syndicates—including ShinyHunters, Helix, and groups tracked as Storm-3121 and Storm-3032—are conducting highly coordinated social engineering campaigns centered on passkey and Single Sign-On (SSO) updates. Since May 2026, these operators have targeted corporate personnel to execute Adversary-in-the-Middle (AiTM) and device-code phishing attacks, granting adversaries persistent session access across enterprise Microsoft 365 environments.

Once inside victim tenants, the actors deploy automated scripts leveraging Microsoft Graph to enumerate cloud resources and systematically exfiltrate corporate repositories across SharePoint Online, OneDrive for Business, and Exchange Online using low-and-slow data exfiltration techniques.

Pre-Attack Profiling & Social Engineering Tradecraft

High-Touch IT Help Desk Impersonation

The attack lifecycle begins with extensive open-source reconnaissance. Operators profile employee hierarchies and departmental structures via professional social networks before initiating contact via voice calls or direct SMS messaging. Attackers masquerade as corporate IT support personnel, generating false urgency by claiming that the employee must immediately configure a new corporate passkey, multi-factor authentication (MFA), or SSO credential to preserve system access.

Typo-Squatted Passkey Infrastructure

Victims are directed to look-alike authentication portals engineered to mirror genuine Microsoft identity pages. The syndicate routinely registers typo-squatted domains incorporating organizational names combined with authentication keywords, including passkeyhelpdesk[.]com, secure-passkey[.]com, setupmypasskey[.]com, add-passkey[.]com, integratedsso[.]com, and oktasession[.]com. Target company names are typically staged within subdomains to maximize authenticity.

Exploitation & Cloud Post-Compromise Mechanics

AiTM Interception & Device-Code Flow Hijacking

While the lures focus on passkeys, adversaries do not register genuine passkey credentials. Instead, the lures trick users into authenticating through AiTM reverse proxies—which intercept plaintext passwords and primary session tokens—or authorize malicious clients via legitimate device-code authentication flows. By entering an attacker-provided code into Microsoft's legitimate device portal, the employee issues an unauthorized OAuth token to the adversary's client application, completely bypassing secondary MFA prompts.

Persistence via Rogue Multi-Factor Authentication

Upon securing access to the OfficeHome interface on unmanaged devices, the actors entrench themselves within the victim's tenant. Attackers establish persistent access by registering attacker-controlled authentication methods, such as secondary phone numbers, rogue authenticator applications, and software TOTP tokens under the compromised user's identity. This enables attackers to satisfy future MFA challenges independently.

Automated Reconnaissance & Low-and-Slow Data Theft

Microsoft Graph Enumeration via Node.js

Adversaries utilize automated Node.js tooling to systematically query the Microsoft Graph API. Reconnaissance routines rapidly query endpoints including /users, /groups, and /sites, mapping tenant directory roles, privileged accounts, service principals, and application permissions. Because standard enterprise administrative tools frequently make identical API calls, initial enumeration blends seamlessly into background administrative noise.

Stealthy Exfiltration from SharePoint & OneDrive

Following reconnaissance, the threat actors execute data collection via automated scripts utilizing the python-httpx client user-agent. High volumes of FileAccessed and FileDownloaded audit events are recorded across SharePoint Online and OneDrive for Business, alongside REST API extraction of mailboxes via Exchange Online. To evade volume-based threshold detections, attackers pace exfiltration across multiple days, capping download velocity to fewer than 1,000 files or emails per hour.

Threat Actor Attribution & Overlapping Clusters

Microsoft attributes this activity to Storm-3121 (associated with ShinyHunters and Falcon extortion) and Storm-3032 (linked to BlackFile extortion actors operating under the Helix moniker). This operational footprint directly overlaps with the UNC6671 threat cluster documented by Google Threat Intelligence, which has targeted global enterprises across finance, technology, and manufacturing sectors.

Mitigation & Threat Detection Strategies

Tactical Identity Controls

• Enforce strict Conditional Access policies requiring compliant, corporate-managed devices for accessing corporate Microsoft 365 and connected SSO platforms.
• Disable OAuth device-code authentication flows across all enterprise Entra ID policies unless explicitly mandated by specialized operational requirements.
• Mandate phishing-resistant FIDO2 security keys, which enforce cryptographic origin binding and cannot be intercepted by AiTM proxies or manipulated via fake passkey lures.

Architecture Hardening & Graph Telemetry Auditing

• Configure real-time alerts for anomalous user agent telemetry, specifically monitoring for python-httpx requests accessing SharePoint, OneDrive, and Exchange APIs.
• Establish automated incident response playbooks to immediately revoke active sessions, invalidate OAuth refresh tokens, and remove newly registered authentication methods whenever suspicious sign-in events are detected.