Microsoft says threat actors posing as IT helpdesk staff are tricking employees into phishing and device-code attacks that lead to persistent cloud access.
Attackers are using passkey-themed social engineering to trick employees into giving them access to their Microsoft accounts.
Microsoft Security Research said it has been tracking active cloud intrusions since May in which attackers impersonated IT helpdesk staff, told employees they needed to update or enroll a passkey, and then took them to adversary-in-the-middle (AiTM) phishing pages or Microsoft device-code authentication flows.
The campaign ultimately gave attackers access to compromised cloud identities, allowing them to register their own authentication methods, map the victim’s Microsoft 365 environment, and access cloud-hosted files and emails.
“The passkey in this campaign is the lure, not the weakness,” said Jon Baker, VP of Threat-Informed Defense at AttackIQ. “The MFA that got bypassed was phishable. Real passkeys would have stopped it.”
Identity compromised through a helpdesk call
The attacks commonly begin with a phone call or message to an employee’s personal mobile number from someone claiming to be from the organization’s IT helpdesk. The attacker tells the employee that a passkey, MFA or SSO configuration needs to be updated immediately to avoid disruption.
The victim is then redirected to a website that resembles a Microsoft sign-in page. In AiTM attacks, the adversary can capture credentials and session tokens. In device-code attacks, the victim is instead told to enter a code on a legitimate Microsoft authentication page, authorizing an attacker-controlled client.
Microsoft says the initial interaction can leave little endpoint evidence, particularly when the victim opens the phishing link on a personal device that is not managed by Microsoft Defender for Endpoint.
In some cases, attackers also used already-compromised accounts to send passkey-themed messages via Microsoft Teams, making the requests appear to come from a trusted colleague.
The campaign is not limited to a single attack pattern. Microsoft also observed cases in which attackers used credentials and MFA methods that had apparently been registered days earlier, suggesting that MFA persistence had already been established.
Attackers registered their own authentication methods
Once an identity was compromised, Microsoft observed attackers registering authentication methods under their control, including phone numbers, authenticator applications, and software-based OTP tokens. This gave them a way to satisfy future MFA challenges without the legitimate user.
Attackers then used Microsoft Graph to enumerate users, groups, roles, authentication methods, applications, and cloud resources. They subsequently moved into SharePoint and OneDrive to locate and access files, while some intrusions involved Exchange Online and REST API-based access to email.
“The actor registers their own authenticator method, maps the tenant through Microsoft Graph, and pulls files and mail at a pace that reads like a busy employee,” Baker said. “None of those calls is suspicious on its own. The sequence is.”
Signs of automation were observed in some cases, including the “python-httpx” user agent associated with high-volume SharePoint and OneDrive activity. Attackers also maintained a controlled pace, with fewer than 1000 files or emails accessed in an hour, potentially allowing the activity to blend into normal enterprise behavior.
Microsoft has recommended correlating unusual sign-ins with new authentication method registrations, Graph reconnaissance, and abnormal SharePoint, OneDrive, and Exchange activity. It also advised enforcing phishing-resistant MFA via Conditional Access and blocking device-code and authentication-transfer flows where there is no legitimate business need.