Microsoft 365: The New Passkey Phishing Scam in 2026

Your phone rings.

The person on the line introduces themselves as a member of IT support.

They know your company's name.

They sound professional.

They explain that a Microsoft 365 security update is required.

"We're migrating accounts to passkeys. You need to complete the procedure today to avoid losing access to your email."

A few moments later, you receive a text message.

It contains a link.

The page looks like Microsoft.

You follow the instructions.

And without necessarily realising it, you may have just authorised an attacker to access your company's environment.

This scenario is not merely a theoretical demonstration.

On September 9, 2026, Microsoft Security Research published a detailed analysis of campaigns using precisely this type of manipulation.

What Microsoft Actually Discovered

Since May 2026, Microsoft has observed operations targeting corporate accounts through phishing scenarios related to passkeys and Single Sign-On (SSO).

Attackers may contact employees on their personal phones.

They impersonate IT support.

They talk about MFA updates, SSO configuration or passkey migration.

The objective is not necessarily to create a genuine passkey.

It is to convince the user to perform an authentication action that benefits the attacker.

Microsoft describes two techniques in particular:

Adversary-in-the-Middle (AiTM) phishing, which can intercept authentication information and session tokens.
Device code phishing, which tricks victims into authorising an attacker-controlled session, sometimes through a genuine Microsoft page.

This distinction is essential.

Passkeys themselves are not inherently compromised. Attackers are exploiting users' trust in what appears to be a legitimate security procedure.

Source: Microsoft Security Research — September 9, 2026

The Trap of the Genuine Microsoft Website

This is probably the most confusing part.

In certain attacks involving the device code mechanism, the user is asked to enter a code on a legitimate Microsoft authentication page.

The page may be genuine.

So may its HTTPS certificate.

But the code was supplied in the context of a fraudulent request.

By entering it, the victim may authorise an attacker-controlled client to obtain an access token.

So this is not always a fake website full of spelling mistakes.

A perfectly legitimate service can be misused as part of a fraudulent process.

That is why simply telling employees to "check the HTTPS padlock" is no longer enough.

Once Connected, What Does the Attacker Look For?

Microsoft observed several behaviours following identity compromise.

First, attackers explore the environment.

They identify accessible applications.

They query Microsoft Graph.

They examine SharePoint and OneDrive resources.

They may then collect files, emails or attachments, depending on the compromised account's permissions.

In some operations, Microsoft also observed the registration of new authentication methods.

This can make remediation more difficult if the company simply changes the password.

The risk becomes particularly significant when an account has broad access to internal data.

A sales account may provide access to contracts.

An HR account may expose employee records.

An executive account may provide access to financial information.

And the attacker does not always need to compromise the employee's work computer to reach this data.

Why Your Antivirus May See Nothing

Imagine an employee receiving the text message on their personal phone.

They open the link on that device.

Then they approve the authentication request.

No malware necessarily needs to be installed on their work computer.

The problem lies in the digital identity and access tokens.

Microsoft notes that the use of unmanaged personal devices can make the early stages of some attacks difficult to reconstruct.

This is why endpoint protection cannot replace identity and cloud-service monitoring.

Warning Signs That Should Trigger an Investigation

A company with the necessary logs and licences can look for several indicators.

For example:

An unusual sign-in followed by the registration of a new MFA method.
Unexpected device-code authentication events.
An unfamiliar device or location.
Unusual Microsoft Graph activity.
Abnormal download volumes in SharePoint or OneDrive.
Mailbox access that does not match the user's usual behaviour.

One isolated indicator does not prove an account has been compromised.

What matters is the sequence of events.

A new authentication method followed by cloud resource discovery and unusual document downloads deserves particular attention.

What Protections Should Be Put in Place?

1. Strictly Control IT Support Procedures

An employee should not approve a new authentication procedure simply because someone calls them.

Establish a trusted internal channel for verifying IT support requests.

2. Use Phishing-Resistant MFA

Phishing-resistant authentication methods, correctly deployed and combined with appropriate access policies, reduce exposure to certain attacks.

This does not mean attackers can no longer manipulate users.

Security awareness must therefore cover fake passkey and SSO migration scenarios.

3. Control Device-Code Authentication

Microsoft recommends blocking device-code flows and certain authentication transfer flows where there is no identified business need.

Before blocking them, you should identify legitimate applications that depend on those mechanisms.

4. Monitor New MFA Methods

The registration of a new authentication method should be traceable.

An unexpected change on a sensitive account deserves investigation.

5. Limit Access to Data

A compromised account should not be able to download every company document without restrictions.

Limiting permissions, applying Conditional Access policies and controlling downloads on unmanaged devices can reduce the consequences of compromise.

What If an Employee Has Already Followed the Fake Procedure?

Do not simply ask them to change their password.

You need to determine whether the attacker obtained a session or authorisation.

Investigation and remediation measures may include:

Reviewing sign-ins and authentication events.
Revoking relevant active sessions and refresh tokens.
Checking registered MFA methods and devices.
Reviewing application consent and OAuth access.
Examining Exchange, SharePoint and OneDrive activity.
Identifying files potentially accessed or downloaded.
Securing the account and monitoring for persistent activity.

The exact procedure depends on what the investigation reveals.

The key is not to close the incident simply because the password has been changed.

A Simple Question for Your IT Manager

"If an employee authorised a fraudulent Microsoft 365 session today, would we be able to identify which documents were subsequently accessed?"

The answer should not be based on assumptions.

It should depend on available logs, appropriate retention policies and the practical ability to analyse events.

This is the principle behind cybersecurity that no longer focuses solely on blocking known attacks, but also on detecting abnormal behaviour.

At Cyberhack, we see this visibility as an essential part of a serious security strategy.

You can learn more about our approach to cybersecurity.

Conclusion

The campaigns observed in 2026 show that attackers know how to turn a security measure into a pretext for fraud.

A passkey.

An MFA procedure.

An SSO migration.

A call from IT support.

All these elements may seem perfectly legitimate.

But a request is not safe simply because it mentions security.

And an authentication page is not necessarily part of a legitimate operation simply because the page itself is genuine.

The rule to remember is simple:

Before approving an unexpected authentication request, independently verify who requested it and why.

For a business, the next step is equally important: having the means to detect fraudulent access quickly if that first verification fails.