Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data
-
Microsoft has disclosed details of two distinct campaigns that abuse third-party email delivery infrastructure and passkey-themed social engineering to compromise cloud accounts and exfiltrate data.
The first campaign involved sending over one million scam emails between August 3 and 5, 2026, with the attackers masquerading as chief executive officers to push financial fraud messages. The second campaign leveraged passkey-themed phishing lures to breach cloud environments, highlighting how attackers continue to adapt social engineering tactics around emerging authentication technologies.
Key points from the disclosure:
- Threat actors abused third-party email delivery infrastructure to distribute scam messages at scale
- More than one million fraudulent emails were sent over a three-day window
- Attackers impersonated chief executive officers to lend credibility to financial fraud attempts
- A separate campaign used passkey-themed social engineering to hijack Microsoft cloud accounts
- The end goal in the cloud campaign included data exfiltration
The abuse of legitimate third-party email infrastructure makes detection harder, since messages may originate from reputable services rather than suspicious domains. The passkey-themed approach is notable because it targets users who may associate passkeys with stronger security, potentially lowering their guard against phishing attempts.
No specific CVE identifiers or advisory numbers were provided in the source material.
Source: The Hacker News
Has your organization seen any passkey-themed phishing attempts, and how are you training users to recognize them?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login