Image: barracuda.com · rights & removal

Passkey phishing attacks: Why Microsoft 365 security can't stop at sign

Reporting by Barracuda BlogRead the original at blog.barracuda.com

Executive Summary

Passkey phishing attacks leverage passkeys, Multi-Factor Authentication (MFA), and Single Sign-On (SSO) updates as social engineering lures to compromise Microsoft 365 accounts. The initial goal of these attacks is not the passkey itself, but gaining access to the M365 environment. After initial sign-in, threat actors focus on persistence by adding controlled authentication methods and mapping the organization's structure by exploring Microsoft Graph, SharePoint, OneDrive, and Exchange Online. While individual activities within these services appear normal to automated monitoring systems, the danger emerges when these events are correlated—such as a successful sign-in followed by MFA changes and subsequent reconnaissance of cloud data. This shifts the incident from a simple phishing event to a broader cloud security incident involving identity compromise and data collection.

Facts Only

* Threat actors use passkey, MFA, or SSO updates as lures for social engineering.
* Attackers pursue access to Microsoft 365 accounts after initial compromise.
* Attackers added authentication methods they controlled and explored the Microsoft 365 environment post-access.
* Attackers focused on persistence by registering new authentication methods.
* Attackers mapped the organization by exploring access to resources like SharePoint, OneDrive, Exchange Online, and Microsoft Graph.
* A successful sign-in was followed by MFA changes, which led to tenant reconnaissance.
* The activity within legitimate Microsoft 365 services appeared normal in isolation but revealed a progression when correlated.
* Identity compromise in this context involves targeting collaboration tools, cloud storage, and organizational knowledge beyond email security.

Full Take

The narrative pivots from defending the perimeter to securing the identity fabric of the cloud. The core pattern observed is the deliberate exploitation of established trust mechanisms—specifically, the inherent reliance on identity as the ultimate control point. Attackers understand that surface-level technological defenses like strong passkeys are insufficient if the underlying concept of organizational trust is compromised. The focus shifting from *prevention* (stopping the initial click) to *detection and remediation* after successful authentication highlights a fundamental gap in traditional security models, which often prioritize ingress control over internal lateral movement awareness. This suggests that security strategies must integrate continuous behavioral correlation across disparate identity signals rather than treating authentication as a discrete checkpoint. The implicit assumption being challenged is that strong authentication inherently seals the environment; instead, it merely sets a new, highly valuable entry point that requires specialized post-entry monitoring to manage the consequences of trust exploitation. What methodologies can effectively link these seemingly benign operational events into a continuous threat picture across the entire identity and data ecosystem?

From the original · Barracuda Blog

in Passkey-themed phishing attacks are being used to compromise Microsoft 365 accounts. Here’s why organizations need identity protection, account takeover detection, and post-sign-in visibility to stop attackers after initial access.

Read the full story at blog.barracuda.com

Sentinel — Human

Confidence

The text reads like a high-level analysis synthesizing known security research into actionable, principle-based guidance, exhibiting the flow and emphasis typical of expert commentary rather than raw reporting.

Signals Detected

Moderate sentence length variance; thematic focus maintained through structural shifts.

Strong logical progression that moves from a specific attack (passkeys) to a broader principle (post-sign-in visibility).

Attribution is primarily internal (Microsoft research findings), lacking external, disparate talking points.

Claims align closely with known enterprise security discourse; no egregious factual errors detected.

Human Indicators

Use of nuanced, abstract framing (e.g., 'The real risk begins after attackers gain access') rather than purely technical reporting.

Emphasis on the conceptual shift in security thinking ('Security becomes a different problem after authentication').

A concluding synthesis that transcends the immediate topic to address trust and persistence.