The first campaign involved sending over one million scam emails between August 3 and 5, 2026, with the attackers masquerading as chief executive officers to push financial fraud messages. The second campaign leveraged passkey-themed phishing lures to breach cloud environments, highlighting how attackers continue to adapt social engineering tactics around emerging authentication technologies.

Key points from the disclosure:

• Threat actors abused third-party email delivery infrastructure to distribute scam messages at scale
• More than one million fraudulent emails were sent over a three-day window
• Attackers impersonated chief executive officers to lend credibility to financial fraud attempts
• A separate campaign used passkey-themed social engineering to hijack Microsoft cloud accounts
• The end goal in the cloud campaign included data exfiltration

The abuse of legitimate third-party email infrastructure makes detection harder, since messages may originate from reputable services rather than suspicious domains. The passkey-themed approach is notable because it targets users who may associate passkeys with stronger security, potentially lowering their guard against phishing attempts.

No specific CVE identifiers or advisory numbers were provided in the source material.

Source: The Hacker News

Has your organization seen any passkey-themed phishing attempts, and how are you training users to recognize them?