Microsoft Warns of Phishing Campaigns Weaponizing Passkey Transition

Microsoft has identified a sophisticated phishing campaign that leverages the company's transition to passkeys to hijack cloud accounts. The attacks use social engineering to deceive users into granting attackers persistent access to Microsoft 365 environments, enabling large-scale data theft.

According to Microsoft Security Research, threat actors are employing a "passkey" narrative as a pretext to guide victims through adversary-in-the-middle (AiTM) phishing or device-code authentication flows. These techniques are designed to hijack user sessions and bypass traditional security layers. Once initial access is secured, the attackers utilize the Microsoft Graph API to conduct identity discovery, perform privilege checks, and systematically exfiltrate sensitive data from cloud environments.

The Transition Pretext

These attacks are timed to coincide with a broader strategic shift in Microsoft's authentication ecosystem. Starting September 1, 2026, Microsoft began transitioning to passkeys as the default authentication method in Entra ID while simultaneously phasing out less secure SMS and voice-based multi-factor authentication (MFA).

By aligning their lures with this official rollout, attackers create a plausible sense of urgency. Victims are often contacted via phone, SMS, or Microsoft Teams by individuals impersonating IT helpdesk staff. These attackers claim that users must urgently update their passkeys or MFA settings to avoid losing access to their accounts, making the fraudulent requests appear as routine corporate security updates.

Industry Implications

This campaign highlights a critical vulnerability in the deployment of new security standards: the human element. While passkeys are technically more secure than passwords, the process of migrating users to these systems creates a window of opportunity for social engineers to weaponize the transition itself.

Furthermore, the abuse of the Microsoft Graph API demonstrates how attackers can turn legitimate administrative tools against an organization. By using these APIs, threat actors can map an entire organization's cloud infrastructure and extract data from SharePoint, OneDrive, and Exchange without triggering the typical alarms associated with bulk data downloads or unauthorized login attempts.

What to Watch

Security teams are advised to monitor for unusual Graph API activity and reinforce user training regarding the official channels used for MFA updates. While the technical shift to passkeys is intended to reduce the risk of credential theft, this campaign proves that threat actors will rapidly adapt their tactics to exploit the confusion surrounding new security protocols. It remains to be seen if similar "migration-themed" attacks will emerge as other major cloud providers move toward passwordless authentication.