Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data

Microsoft has revealed two coordinated attacks that leveraged third‑party email services and a novel “passkey” lure to compromise cloud accounts and siphon data. The campaigns illustrate how attackers fuse mass‑mail fraud with credential‑theft tactics to breach even hardened enterprise environments. Understanding the mechanics is essential for any organization that relies on Microsoft’s cloud platform.

Mass‑Mail Campaign Using Third‑Party Email Infrastructure

The first operation dispatched over a million scam emails in a three‑day window from August 3 to 5, 2026. By routing the messages through external email delivery providers, the actors evaded Microsoft’s inbound filtering and appeared legitimate to recipients. This volume and timing amplified the likelihood that at least some targets would engage with the malicious content.

Attackers impersonated chief executive officers, a classic “CEO‑fraud” approach that exploits hierarchical trust. The forged messages contained financial fraud requests, prompting recipients to transfer funds or disclose credentials. Because the emails originated from reputable third‑party domains, many corporate mail systems flagged them as low‑risk.

Passkey‑Themed Social Engineering to Hijack Cloud Accounts

Simultaneously, threat actors introduced a “passkey” narrative, capitalizing on growing awareness of password‑less authentication. The phishing lures claimed to offer a secure passkey enrollment link, enticing users to click and inadvertently surrender authentication tokens. This technique subverts the security advantage of passkeys by turning the user’s trust in the method against them.

Once a victim entered the counterfeit portal, the attackers harvested the generated passkey data, granting them direct access to Microsoft cloud resources. Unlike traditional password theft, the stolen passkey bypasses multi‑factor checks that rely on knowledge‑based factors. The result is a foothold that can persist until the compromised credential is revoked.

Data Exfiltration and Cloud Impact

With cloud accounts under their control, the adversaries proceeded to locate and extract sensitive files, emails, and configuration data. Microsoft’s investigation confirmed that the exfiltration was systematic, targeting high‑value assets across multiple tenants. The breach demonstrates that once a single account is compromised, lateral movement within the cloud can be swift and extensive.

Microsoft’s response included revoking the abused passkey tokens and tightening verification for third‑party email senders. However, the incident underscores a broader risk: reliance on external email infrastructure can create blind spots in an organization’s threat‑detection capabilities. Continuous monitoring of authentication flows and email provenance remains a critical defense layer.

What This Actually Means For You

1. Mass‑mail scams can bypass traditional spam filters when sent through reputable third‑party services; scrutinize sender domains beyond internal policies.
2. Passkey‑based phishing exploits user confidence in password‑less login; verify any enrollment link through official channels before interacting.
3. Compromise of a single cloud account can enable large‑scale data theft; enforce least‑privilege access and regular credential rotation.
4. Monitoring for anomalous authentication events, especially passkey generation, is essential to detect early intrusion signs.
5. Rapid revocation of compromised credentials limits attacker dwell time and reduces potential data loss.

Immediate Action Steps

Audit recent inbound emails for unexpected third‑party domains, especially those claiming executive authority, and flag any that request credential actions. Deploy email authentication standards such as DMARC, DKIM, and SPF to reduce spoofing success.

Review your organization’s passkey enrollment procedures; ensure that all enrollment URLs are hosted on verified Microsoft domains and that users receive clear guidance on legitimate processes. Implement conditional access policies that require additional verification for passkey creation events.

Frequently Asked Questions

How did attackers use passkey phishing to hijack Microsoft cloud accounts?

They sent fraudulent messages that mimicked legitimate passkey enrollment prompts, leading victims to submit authentication data on a counterfeit site. The harvested passkey data granted the attackers direct access to the victims’ cloud accounts, bypassing traditional password checks.

Why did the email blast succeed despite Microsoft’s spam protections?

The campaign leveraged third‑party email delivery infrastructure, which is often trusted by corporate mail systems. By masquerading as CEOs and using reputable sender domains, the messages avoided typical spam filters.

What immediate measures can organizations take to prevent similar attacks?

Enforce strict verification of any passkey enrollment links and apply DMARC/DKIM/SPF to authenticate incoming mail. Additionally, monitor for unusual passkey generation activity and revoke compromised credentials promptly.

What Do You Think?

Given the blend of mass‑mail fraud and sophisticated passkey deception, should enterprises rethink their reliance on third‑party email services as a core component of their security posture?