An attacker may never need your password if they can convince a legitimate employee to authenticate an attacker-controlled session.
Executive Summary
Microsoft 365 account compromise is evolving. The activity analysed here shows how attackers can manipulate the authentication process itself instead of relying only on password theft.
Microsoft has described a campaign in which threat actors impersonate corporate IT helpdesk personnel and contact employees through phone calls or SMS. The story is often framed around passkeys, MFA or SSO configuration, creating pressure to complete an authentication step.
The victim is then guided toward a Microsoft-looking authentication workflow. Behind the scenes, the attacker may be using Adversary-in-the-Middle (AiTM) phishing or abusing the OAuth device-code authentication flow.
1. What Is Happening?
The opening can sound completely normal:
The contact may arrive on a personal phone number or by SMS. That matters because the initial social-engineering interaction can occur outside traditional corporate endpoint telemetry.
Microsoft reports that attackers use fake authentication websites and organization-specific URLs to make the interaction appear legitimate. The passkey or SSO story is often the lure; the underlying objective can be token access, authentication abuse and cloud reconnaissance.
2. The Passkey Story May Be the Lure β Not the Objective
What the employee hears
βYou need to register your new passkey.β
βYour MFA settings must be updated.β
βSSO will stop working unless you act now.β
What the attacker may actually want
AiTM phishing, a device-code session, access tokens, authentication persistence and a foothold into Microsoft 365 resources.
Microsoft has observed both AiTM and device-code techniques in this activity. The key social-engineering trick is to make the victim perform a legitimate authentication action for an attacker-controlled session.
3. How Device-Code Phishing Works
Device-code authentication is a legitimate OAuth authentication mechanism designed for devices or applications with limited input capabilities. The security problem appears when an attacker starts the flow and convinces the victim to enter the attacker's code on a legitimate Microsoft authentication page.
The victim may genuinely believe they authenticated their own Microsoft 365 session. In reality, they may have authenticated the attacker's session. Microsoft notes that device-code abuse can provide an attacker with a valid token without requiring theft of the victim's browser cookie.
4. Why MFA Doesn't Automatically Stop the Attack
Consider an employee who receives an unexpected request to approve a Microsoft 365 login. The Microsoft authentication page may be genuine. The MFA approval may also be genuine.
The critical question is who initiated the authentication flow.
It is βIs our MFA process resistant to phishing and authentication-flow manipulation?β
Microsoft recommends phishing-resistant authentication such as FIDO2/passkeys and recommends controlling device-code authentication where it is unnecessary.
5. Attackers Can Add Their Own MFA
Initial access may only be the beginning. Microsoft observed attackers registering additional authentication methods, including phone numbers, Authenticator applications and software-based OTP methods.
The attacker is effectively trying to turn a temporary compromise into a repeatable way back into the account.
6. Microsoft Graph Becomes a Reconnaissance Tool
Microsoft Graph provides legitimate APIs for interacting with Microsoft 365 resources. Once an attacker controls an identity, those same capabilities can become a powerful reconnaissance source.
Identity & permissions
Users, groups, directory roles, authentication methods, applications, service principals and OAuth permissions.
Cloud resources
SharePoint sites, OneDrive resources, mailbox folders, emails and attachments.
A single API request can look legitimate. The security signal emerges when defenders correlate the sequence:
7. The Attackers Are Not Necessarily Loud
Cloud collection does not have to look like a huge burst of activity. Microsoft observed SharePoint and OneDrive access at scale and described cases where collection was deliberately paced below 1,000 files or messages per hour.
That creates an important detection lesson: a SOC that only searches for extreme spikes such as β10,000 files downloaded in five minutesβ can miss a low-and-slow collection pattern.
8. The Complete Attack Chain
Social Engineering
Fake IT helpdesk call or SMS creates urgency around MFA, SSO or passkey configuration.
Authentication Lure
The employee receives a Microsoft-looking authentication experience.
AiTM / Device Code
The attacker attempts to obtain credentials/session tokens or an attacker-controlled device-code session.
Account Access
An authenticated session or token gives the attacker a cloud foothold.
MFA Persistence
Additional authentication methods may be registered.
Cloud Recon
Graph is used to map users, groups, roles, applications, permissions and resources.
Data Collection
Emails, attachments, SharePoint, OneDrive and other business files become targets.
Potential Exfiltration
Sensitive information can ultimately leave the organization's control.
9. What Information Could Be Valuable?
The attacker does not necessarily need an administrator account. Depending on permissions, an ordinary employee identity can expose valuable business information.
π§ Email
Customer communications, contracts, invoices, internal discussions and attachments.
π SharePoint
Policies, project documents, reports, presentations and business records.
βοΈ OneDrive
Work files, spreadsheets, presentations and confidential documents.
π₯ Identity data
Users, groups, roles and organisational structure.
π Application data
OAuth applications, service principals and permission relationships.
π° Business & IP
Invoices, procurement documents, payment discussions, product plans, designs and research.
This makes Microsoft 365 identity compromise a potential business-data compromise, not merely an email-security incident.
10. Why Personal Devices Make Investigation Harder
The initial phishing call or SMS may arrive on an employee's personal mobile device. If that device is not enrolled in corporate endpoint security, the organisation may have little or no endpoint telemetry showing the first interaction.
Investigators may instead have to reconstruct the opening of the incident from:
The employee's recollection of the unsolicited call or SMS can therefore become an important part of the forensic timeline.
11. What Should SOC Teams Hunt For?
| Area | Hunt for |
|---|---|
| Identity | Impossible or unusual sign-ins, anonymous/proxy infrastructure, unfamiliar locations, new authentication methods and unexpected Authenticator or phone/OTP registrations. |
| Microsoft Graph | Sudden directory enumeration, role discovery, application/OAuth permission discovery, large API request volumes and unusual paging activity. |
| SharePoint / OneDrive | Unusual file access, access outside normal patterns, new locations, automated retrieval, high-volume collection and unusual user agents. |
| Exchange | Large-scale mailbox access, attachment collection, suspicious inbox rules, unusual REST API activity and unexpected forwarding behaviour. |
Microsoft specifically recommends correlating Graph activity with SharePoint, OneDrive, Exchange and mailbox activity rather than investigating each signal independently.
12. What Should an Organisation Do After Suspected Compromise?
Do not simply reset the password and close the ticket. Treat the incident as a potential identity-and-cloud investigation.
Microsoft's response guidance emphasises validating and removing unauthorized authentication methods, revoking sessions and investigating token issuance/sign-in activity after suspected compromise.
13. Prevention: What Organisations Should Change
π 1 Β· Use phishing-resistant MFA
Prefer FIDO2 security keys, passkeys and other phishing-resistant authentication methods where supported.
π« 2 Β· Control device-code authentication
If the organisation does not need device-code flow, block or restrict it. Where it is required, document and tightly scope the exception.
π€ 3 Β· Protect MFA registration
Monitor who registered a new method, when, from where, and whether a suspicious sign-in preceded the change.
π 4 Β· Monitor cloud behaviour
Correlate sign-in β token β Graph β mailbox β SharePoint β OneDrive rather than treating login as the end of the security story.
π 5 Β· Build behaviour-based detection
Consider user, device, location, token, authentication method, API behaviour, resource accessed, volume, time and historical baseline.
π‘οΈ 6 Β· Review app consent
Restrict user consent where appropriate, require admin approval and regularly review high-privilege Graph permissions.
14. Employee Awareness: The Simplest Control
Be suspicious if someone asks you to:
15. MITRE ATT&CK Mapping
| Technique | Relevance |
|---|---|
| T1566 β Phishing | Social-engineering and authentication lures. |
| T1528 β Steal Application Access Token | Theft or abuse of OAuth/application access tokens. |
| T1098 β Account Manipulation | Adding attacker-controlled authentication mechanisms. |
| T1087.004 β Cloud Account Discovery | Enumerating cloud identities. |
| T1526 β Cloud Service Dashboard | Discovery of cloud services and resources. |
| T1530 β Data from Cloud Storage | Collection from cloud storage such as SharePoint/OneDrive. |
The exact technique mapping depends on the telemetry and attack sequence confirmed during an investigation.
16. Reported Campaign Indicators
The source material reports these domains as campaign-related indicators:
passkeyhelpdesk[.]comsecure-passkey[.]comsetupmypasskey[.]comadd-passkey[.]comintegratedsso[.]comoktasession[.]comkeysyncos[.]com17. The Bigger Security Lesson
The older mental model is being challenged by cloud identity attacks.
The attacker may never deploy malware, exploit a server or crack a password. They may simply convince a legitimate employee to perform a legitimate authentication action on their behalf.
18. CyberRakshakLabs Threat Assessment
Threat Level
π΄ HIGH
Primary Risk
Identity compromise leading to cloud-resource access and persistence.
Secondary risks
Most important defensive priorities
19. Final CyberRakshakLabs Takeaway
MFA remains one of the most important identity controls. But attackers are increasingly targeting the human and authentication workflow around MFA.
The security question is no longer simply:
βWho did the employee just authenticate?β
Because sometimes the attacker doesn't need your password. They don't need to defeat MFA. They just need you to approve their login.
Research Basis & Official References
Primary technical basis: Microsoft Security Research's September 9, 2026 analysis of passkey-themed social engineering, AiTM/device-code abuse, MFA persistence, Microsoft Graph reconnaissance and cloud data collection.
Microsoft Learn β Configure Security Defaults for Microsoft Entra ID β
Microsoft Learn β Block authentication flows with Conditional Access β
Campaign indicators and several contextual details in this article are presented as reported threat-intelligence indicators. They should be independently validated before being used for blocking or attribution.
Think Before You Click. Stay Aware. Stay Secure.
CyberRakshakLabs β Threat Intelligence for a Safer Tomorrow.