Fake passkey alerts used to phish and steal Microsoft 365 data
Microsoft has disclosed two ongoing campaigns in which attackers impersonate corporate IT support to gain access to Microsoft 365 accounts.
The attackers first research employees and the structure of a company, often using social media, then call or message staff, sometimes sending links via SMS to personal phones.
They claim that a passkey, multi-factor authentication, or single sign-on setting urgently needs updating or access will be lost, and direct the employee to a fake Microsoft login page.
On that page, victims either type in their login details directly, which are then captured, or they enter a code supplied by the attacker on the real Microsoft page, which lets the attacker in without needing another multi-factor check.
According to Microsoft, the group behind these attacks invests heavily in preparation, gathering detailed information about employees before targeting them.
Once inside an account, Microsoft observed attackers browsing internal apps, SharePoint, Outlook, and business applications within minutes, sometimes staying active for about an hour to review sensitive files.
Because access runs through single sign-on, it can extend to connected services like Salesforce, Google Workspace, Dropbox, or Slack, widening the potential scope of data theft.
WHY IT MATTERS
The attackers exploit trust in security features like passkeys to trick employees into handing over access, which can expose far more than a single account.
WHAT YOU CAN DO NOW
- Always verify IT requests yourself If you get a supposed IT request, don't call back the number provided. Instead use your company's official internal number or known IT contact.
- Never enter codes from strangers If someone asks you to enter a code on a Microsoft login page that you didn't request yourself, don't do it and contact your IT department instead.
- Check the login page address carefully Before entering any login details, look closely at the web address and watch for odd additions like 'passkeyhelpdesk' or similar word combinations.
- Report suspicious messages right away Tell your IT or security team about any texts, calls, or emails claiming passkey or SSO problems, even if you didn't respond to them.