Passkey phishing is here, and it is not stealing passkeys

Passkeys were supposed to shrink the phishing surface. Instead they became the story attackers tell on the phone. Microsoft Security Research published details in September of active campaigns where threat actors impersonate internal IT, urge urgent passkey or MFA updates, and route victims to adversary-in-the-middle pages or device-code authentication flows.

The playbook Microsoft described

It often starts on a personal mobile number. The caller claims the employee will lose access unless they complete a passkey or SSO update immediately. SMS links land on domains built to sound helpful: passkeyhelpdesk.com, setupmypasskey.com, integratedsso.com, and similar names Microsoft listed in its reporting.

The passkey narrative is cover. Victims are not enrolling a hardware key on a legitimate tenant. They are handing session tokens to an AiTM site or approving a device-code prompt the attacker initiated. Once inside, operators register their own authentication methods, run Microsoft Graph reconnaissance, and pull files from SharePoint Online and OneDrive for Business. Some intrusions extended into Exchange Online through REST APIs.

Microsoft linked the activity to clusters associated with extortion-focused groups including ShinyHunters and Helix naming in public reporting. Automation shows up in logs: high-volume FileAccessed and FileDownloaded events, sometimes with python-httpx user agents, paced to stay under roughly a thousand objects per hour so alarms stay quiet.

Why it works on smart staff

Employees have been trained to fear losing email access before a board meeting. Passkeys are new enough that a helpdesk explanation sounds plausible. Calling a personal phone bypasses corporate email filters entirely. Device-code flows feel modern and official if you have never seen abuse in a demo.

Law firms and professional services shops are ripe targets because document volume in M365 is the business. One compromised partner account can expose matter files, client lists, and trust accounting exports without a single ransomware binary.

Defenses that actually match the threat

• Require phishing-resistant MFA for privileged and legal roles, not only "MFA enabled somewhere."
• Block or tightly scope device-code and authentication-transfer flows unless you have a documented use case.
• Alert on new authentication method registration after risky sign-ins, especially from unmanaged devices.
• Train helpdesk staff to describe how real passkey enrollment works at your org, including that IT will never ask for approval on a personal phone at random.
• Monitor Graph and SharePoint audit logs for sustained download patterns from new sessions.

Bottom line

Modern authentication does not remove social engineering. It changes the script. Forensic Five assesses Microsoft 365 configuration, external identity exposure, and logging readiness for Canadian clients who need clear answers on questionnaires. Based in St. Albert, Alberta. We document what we find and leave the buzzwords at the door.