7 minhigh
Passkey-themed social engineering leads to identity and cloud compromise | Microsoft Security Blog
Passkey-themed vishing and AiTM phishing compromises Microsoft cloud identities, enrolls attacker-controlled MFA, and exfiltrates SharePoint, OneDrive, and Exchange data via automated Graph API access for extortion. Actors use phone-based social engineering with passkey lures to steer victims through AiTM or device-code flows, capturing session tokens. They enroll attacker-controlled MFA methods for persistence, then use Microsoft Graph for tenant reconnaissance and automated high-volume data collection from SharePoint, OneDrive, and Exchange via REST APIs.
Sens:■ Immediate
IOCs15
15domain
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Revoke active sessions and refresh tokens for confirmed compromised identities immediately.
- Remove attacker-registered authentication methods and reset credentials for affected users.
- Block all 15 identified phishing domains at network and email security gateways.
- Review newly registered MFA methods for users with recent unusual sign-ins.
Key Takeaways
- Campaign active since May 2026, tracked across multiple compromised cloud accounts.
- 15 phishing domains registered across passkey, SSO, and key-setup themes.
- Actors rotate separate IPs for authentication, reconnaissance, and exfiltration stages.
- python-httpx user agent observed in automated SharePoint and OneDrive file access.
- Data collection kept under 1,000 files or emails per hour to blend with normal usage.
Attack Chain
- Initial Access: Vishing with passkey-themed lures directs victims to AiTM phishing or device-code authentication flows
- Identity Compromise: Actor captures credentials and session tokens or obtains device-code authorization
- Persistence: Actor enrolls attacker-controlled MFA method (phone, authenticator app, or software OTP)
- Reconnaissance: Actor uses Microsoft Graph to enumerate users, groups, roles, applications, and repositories
- Collection: Actor performs high-volume SharePoint, OneDrive, and Exchange file access via Graph API
- Exfiltration: Automated Python-based scripts slowly extract data over hours to days to blend with normal usage
- Extortion: Actor delivers extortion demand supported by timeline of stolen data and unauthorized access
Affected Systems
- Microsoft Entra ID (Azure AD) identities
- Microsoft SharePoint Online
- Microsoft OneDrive for Business
- Microsoft Exchange Online
- Microsoft Graph API
- Microsoft Teams (used for internal phishing)
Detection Availability
- Published: KQL
- Platforms: Microsoft Defender XDR Advanced Hunting
Multiple KQL hunting queries for Graph reconnaissance, MFA enrollment, and exfiltration detection in Defender XDR.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Initial phishing often occurs on personal mobile devices not onboarded to EDR, leaving gaps. |
| Network Visibility | Medium | Actors rotate IPs across stages; individual Graph API calls appear routine without correlation. |
| Detection Difficulty | Hard | Graph API abuse blends with normal enterprise usage; requires cross-event behavioral correlation across identity, Graph, and workload signals. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Single identity touching multiple Graph reconnaissance categories (directory, privilege, repository, mailbox) from same IP within 30 minutes (T1087.004, T1069.003). | GraphAPIAuditEvents with RequestUri categorization | Discovery | Medium — admin or automation tools may touch multiple Graph endpoints |
| Newly registered MFA device with NO_DEVICE name and SoftwareTokenActivated tag added via Update user operation (T1556.006). | CloudAppEvents with StrongAuthenticationPhoneAppDetail modifications | Persistence | Low — NO_DEVICE and NO_DEVICE_TOKEN are atypical values |
| High-volume file access or download from SharePoint/OneDrive using python-httpx user agent from anonymous proxy IP (T1530, T1567). | CloudAppEvents with FileDownloaded/FileAccessed actions and UserAgent | Exfiltration | Low — python-httpx for M365 file access is unusual |
| Exchange REST API activity exceeding 500 events per hour from a single IP and token object ID (T1114). | CloudAppEvents with ApplicationId 20893 and Exchange REST actions | Collection | Medium — legitimate migration tools may generate high volume |
Required Log Sources
- Microsoft Graph API audit logs
- Entra ID sign-in logs
- SharePoint and OneDrive audit logs
- Exchange mailbox audit logs
- CloudAppEvents (Defender XDR)
- Conditional Access logs
Key Behavioral Indicators
- Sign-in from unmanaged device followed by MFA method enrollment within minutes
- StrongAuthenticationPhoneAppDetail update with NO_DEVICE device name
- python-httpx user agent accessing SharePoint or OneDrive APIs
- Graph session touching 3+ reconnaissance categories within 30 minutes
- Exchange REST API event count exceeding 500 per hour per identity
- Anonymous proxy IP accessing M365 file or mail resources
Control Gaps
- Unmanaged personal devices allowed to access cloud resources without Conditional Access restrictions
- Device code authentication flow enabled without business-need restriction
- Security info registration permitted from unmanaged or untrusted locations
- User consent for Graph-scoped applications not restricted to admin approval
- Graph API activity logs not enabled or not alerting on anomalous enumeration patterns
False Positive Assessment
Medium — Individual Graph API calls and MFA enrollment events are routine in enterprise environments; detection requires correlating identity compromise signals with subsequent reconnaissance and data access patterns rather than single events.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Enforce phishing-resistant MFA (FIDO2 or Windows Hello for Business) via Conditional Access.
- Block device code and authentication transfer flows via Conditional Access unless business-required.
- Require managed, compliant devices for Exchange, SharePoint, and Graph-privileged apps.
- Restrict user consent for applications and require admin approval for high-privilege Graph scopes.
User Protection
- Limit unmanaged device access to web-only sessions without download or sync capability.
- Disable anonymous sharing links in SharePoint and OneDrive.
- Enable Microsoft Graph activity logs and mailbox auditing with alerting.
- Enforce strict Conditional Access for security info registration requiring managed devices.
Security Awareness
- Train users to verify identity through rigorous process before helpdesk-initiated credential or MFA resets.
- Provide a verified internal channel for employees to report unsolicited authentication requests.
- Alert security teams on every helpdesk-initiated credential or MFA reset event.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping12 techniques
Tactic
Reconnaissance
Tactic
Resource Development
Tactic
Initial Access
Tactic
Persistence
Tactic
Discovery
Tactic
Collection
Tactic
Exfiltration
Plain-Language Summary
Attackers call employees pretending to be IT helpdesk, claiming they must update passkeys or multi-factor authentication. Victims are directed to fake sign-in websites that steal their credentials and session tokens. The attackers then add their own authentication devices to maintain access, search through the organization's cloud files and email using automated tools, and slowly download large amounts of data over hours or days. Organizations should require phishing-resistant authentication, block device-code flows, and train employees to verify unsolicited IT support calls.
Additional IOCs
- Domains:
syncmykey[.]com- Key synchronization-themed phishing lure domainmyconnectkey[.]com- Key connection-themed phishing lure domainoskeyconnect[.]com- Key connection-themed phishing lure domainvalidationsetupac[.]com- Account validation and setup phishing domainportalsetuphub[.]com- Portal setup-themed phishing lure domain
Showing defanged values
- domainadd-passkey[.]comPasskey enrollment-themed phishing lure domain
- domainintegratedsso[.]comSSO-themed phishing lure domain
- domainkeysyncos[.]comKey synchronization-themed phishing lure domain
- domainmyconnectkey[.]comKey connection-themed phishing lure domain
- domainoktasession[.]comIdentity-provider session-themed phishing domain
- domainoskeyconnect[.]comKey connection-themed phishing lure domain
- domainoskeyregister[.]comKey registration-themed phishing lure domain
- domainoskeysetup[.]comKey setup-themed phishing lure domain
- domainoskeysync[.]comKey synchronization-themed phishing lure domain
- domainpasskeyhelpdesk[.]comPasskey support-themed phishing lure domain
- domainportalsetuphub[.]comPortal setup-themed phishing lure domain
- domainsecure-passkey[.]comPasskey security-themed phishing lure domain
- domainsetupmypasskey[.]comPasskey setup-themed phishing lure domain
- domainsyncmykey[.]comKey synchronization-themed phishing lure domain
- domainvalidationsetupac[.]comAccount validation and setup phishing domain