"The actor appears to invest heavily in pre-attack research, likely gathering information about employees and organizational structure from public sources such as social networking and professional profiling platforms," explains Microsoft.
Passkey and SSO lures: social engineering redesigned
Since May 2026, Microsoft has observed threat actors using passkey- and single sign-on-themed social engineering to compromise corporate Microsoft accounts and steal data from Microsoft 365 services. Attackers research target organizations and employees, then call or message victims while impersonating corporate IT help desks and claiming an urgent need to update a passkey, multi-factor authentication (MFA), or single sign-on (SSO) configuration to avoid losing access.
Links are sometimes delivered via SMS to employees' personal phones and lead to phishing sites that mimic legitimate Microsoft login pages. Microsoft emphasizes that, despite the passkey framing, the attackers are typically not trying to enroll a passkey. Instead, the passkey narrative is a lure to get victims to sign into adversary-in-the-middle (AiTM) phishing sites or to participate in device-code authentication flows.
Storm-3121, Storm-3032 and an extortion ecosystem
Microsoft attributes the initial-access activity to multiple actors operating in an extortion ecosystem, including clusters it tracks as Storm-3121 and Storm-3032. Storm-3121 is associated with ShinyHunters and Falcon extortion, while Storm-3032 is believed to be tied to BlackFile extortion group members now operating under the Helix name. Microsoft notes overlap with Google Threat Intelligence's UNC6671 reporting, which likewise connected phone-based social engineering and passkey-themed phishing infrastructure to extortion gangs.
Observed phishing domains combine company names with passkey or SSO terminology. Microsoft provided examples such as passkeyhelpdesk[.]com, secure-passkey[.]com, setupmypasskey[.]com, add-passkey[.]com, integratedsso[.]com, oktasession[.]com, keysyncos[.]com, and oskeysync[.]com, often placing the target company as a subdomain (for example, company-name.secure-passkey[.]com) to improve plausibility.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildInside the breached Microsoft 365 session
Microsoft's analysis offers granular detail on what attackers do after they obtain access. In one intrusion, a suspicious sign-in from an unmanaged device to a service logged as "OfficeHome" completed MFA and established a valid session. Within minutes the attacker inspected My Apps, My Profile, Microsoft Approval Management, account-management interfaces and My Sign-Ins, then moved to SharePoint Online, Outlook Web, Microsoft 365 collaboration and search services, an internal business application, and authentication flows tied to virtual desktops.
Sessions in the cases Microsoft reviewed have remained active for roughly an hour, during which attackers listed sensitive files and internal applications. In other incidents, device-code phishing gave attackers an OAuth token when a victim entered a supplied code into Microsoft's legitimate authentication page, permitting access without another MFA challenge. Attackers have also used previously compromised credentials paired with an authenticator app registered earlier to authenticate and run automated reconnaissance via a Node.js system and Microsoft Graph.
Microsoft Graph reconnaissance, data collection, and persistence
After access, attackers use Microsoft Graph to enumerate organizations, licenses, enabled services, users, groups, directory roles, registered authentication methods, applications and service principals, OAuth permissions, SharePoint sites and libraries, OneDrive resources, and email content. Microsoft cautions that Graph requests such as /users, /groups, or /sites are common in enterprises, but the activity becomes suspicious when the same account or token moves rapidly across resources, checks privileges and authentication settings, then begins accessing email, attachments, files, or documents.
Microsoft observed high-volume access and download activity targeting SharePoint Online and OneDrive for Business and some intrusions extending into Exchange Online via REST APIs. Exfiltration appears automated (connections using the python-httpx user agent during SharePoint and OneDrive access) and deliberately paced: attackers often limit activity to fewer than 1,000 files or emails in an hour to blend into legitimate traffic. For persistence, attackers commonly register new phone numbers, authenticator applications, or software-based one-time password tokens with compromised accounts — a persistence method that Microsoft notes does not survive a complete credential and session reset.
Detection signals and recommended remediations from Microsoft
- Detection signals Microsoft recommends watching for: unusual sign-ins followed by new MFA registrations; Microsoft Graph reconnaissance patterns; and suspicious access to SharePoint, OneDrive, or Exchange.
- If an account is compromised: revoke active sessions and tokens, reset credentials, remove authentication methods or mailbox rules added by attackers, and require users to re-register authentication methods.
- Hardening recommendations include using phishing-resistant MFA, limiting sensitive cloud resources to managed devices, and disabling device-code authentication when it is not needed.
What this means for technologists, enterprises, and end users
Technologists and security teams should instrument Microsoft Graph telemetry and look for rapid cross-resource queries tied to a single account or token, and monitor for new MFA methods or authenticator registrations. Enterprises and administrators should be ready to revoke tokens and sessions, perform credential resets, remove attacker-added auth methods and mailbox rules, and consider policy changes such as restricting device-code flows and requiring managed devices for sensitive resources. End users must treat unsolicited help-desk calls or SMS messages about passkey or SSO updates with suspicion, avoid entering device codes supplied by others, and report unexpected MFA enrollment activities.
These incidents show a consistent pattern: attackers invest in pre-attack research, use believable passkey and SSO narratives to bypass normal user caution, and then rely on legitimate authentication pathways and Graph APIs to map and harvest cloud-hosted data. The choice facing defenders is operational as much as technical — will organizations enforce phishing-resistant MFA and remove riskier authentication flows before the next campaign moves from reconnaissance to full-scale exfiltration?
