The attacks rely on convincing users to hand over access under the guise of passkey enrollment or SSO-related activity, rather than exploiting a software flaw. That means the entry point is the user, and the payoff for the attackers is access to cloud-hosted corporate data.

Key points to keep in mind:

• The campaigns are attributed to multiple extortion gangs, among them ShinyHunters and Helix.
• Targets are corporate Microsoft accounts, with data theft focused on Microsoft 365 services.
• The lures center on passkey and single sign-on themes, which makes them harder to spot since both are legitimate, everyday authentication topics.
• There is no indication in the reporting of a specific CVE or product vulnerability being exploited here; this is a social engineering problem, not a patchable bug.

Because these attacks abuse trust in authentication features rather than technical weaknesses, the usual defenses matter more than ever: strong user awareness around credential and passkey requests, conditional access and phishing-resistant authentication policies, and monitoring for unusual sign-ins or data access in Microsoft 365. Organizations should also review how passkey rollouts are communicated internally, since attackers are mimicking exactly that kind of messaging.

Source: BleepingComputer

Has your organization seen any passkey or SSO-themed phishing attempts lately, and how are you handling them?