Attackers are Turning Passkeys into a New Social Engineering Target
Passkeys were designed to reduce phishing risk, but attackers are now using fake passkey updates and support requests to exploit the trust users place in those protections.
Key Takeaways:
- Attackers are impersonating IT support staff to trick users into fake passkey and MFA updates.
- Successful compromises can lead to access across Microsoft 365 services, including SharePoint, OneDrive, Exchange Online, and Microsoft Graph.
- Microsoft recommends stronger monitoring of authentication changes, device code sign-ins, and unusual cloud data access activity.
Organizations are increasingly deploying passkeys and phishing-resistant authentication to strengthen identity security. However, Microsoft Security Research has found that attackers are exploiting employees’ familiarity with these technologies by using passkey-themed social engineering campaigns to gain access to cloud accounts and sensitive corporate data.
🎬 Watch This Week in IT.
According to Microsoft, the attacks typically begin with phone calls, text messages, or Microsoft Teams messages from individuals posing as IT support staff. Victims are told they must urgently update a passkey, MFA setting, or single sign-on configuration. Instead of enrolling a legitimate passkey, victims are directed to phishing pages or device-code authentication workflows that let attackers hijack authenticated sessions.
The level of personalization makes these campaigns particularly effective in enterprise environments. Attackers research organizations, create convincing domains that reference the target company, and often use compromised internal accounts to make requests appear legitimate.
Identity compromise expands into cloud data exposure
Once attackers obtain access, they quickly move beyond the initial account compromise. The research showed threat actors accessing identity management portals, enumerating applications, querying Microsoft Graph, and exploring resources across SharePoint Online, OneDrive, and Exchange Online.
A key step in the attack chain involves registering a new multifactor authentication (MFA) method controlled by the attacker. This creates persistence and enables future access even after the initial phishing event. From there, automated reconnaissance tools can map users, groups, privileges, applications, and document repositories before collecting emails, attachments, and files that may contain sensitive business information.
The research highlights that individual Graph API requests often appear normal in isolation, which makes it difficult for security teams to distinguish malicious activity from legitimate administrative operations.
Focus on behavioral detection and identity protection
Microsoft recommends that security teams monitor for unusual sign-ins, newly added authentication methods, suspicious Microsoft Graph reconnaissance, anomalous SharePoint and OneDrive access patterns, and large-scale data collection activity.
Organizations should also strengthen phishing-resistant authentication, scrutinize MFA registration changes, investigate device code authentication events, revoke active sessions after a compromise, and remove unauthorized authentication methods as part of incident response.
Stronger identity controls require more monitoring
Microsoft noted that passkeys and MFA remain critical security controls, but this research shows that attackers are adapting their tactics rather than abandoning identity-based attacks. Organizations can reduce risk through stronger authentication policies and improved monitoring, but it requires greater visibility across identity, cloud applications, and data platforms.
This challenge for security teams is balancing user convenience with the additional operational effort needed to detect sophisticated social engineering campaigns that now target trusted authentication processes.
Rabia has a master's degree in Software Engineering and she has years of experience writing professionally about Microsoft products and other technologies. Rabia has also written for OnMSFT.com as well as Windows Report. She is always up to date on t...
