GoKawiilShinyHunters-linked hackers use fake passkey alerts to breach Microsoft 365 accounts
Microsoft has detailed a social engineering campaign, active since May 2026, in which attackers tied to groups like ShinyHunters and Helix pose as corporate IT help desks and warn employees their passkey, MFA, or SSO settings need urgent updating. Victims are steered to convincing fake Microsoft login pages—often via SMS to personal phones—where attackers harvest credentials and session tokens using adversary-in-the-middle and device-code phishing techniques, rather than actually registering new passkeys.
GoKawiil's interpretation of the reporting above, not reported fact.
This shows attackers adapting phishing lures to exploit trust in newer, supposedly more secure authentication methods like passkeys, turning a security upgrade into a weapon. Because these attacks steal live session tokens rather than just passwords, they can bypass MFA protections entirely, making them especially dangerous for enterprise environments.
- Attackers impersonate IT help desks, urging fake passkey or SSO updates to create urgency.
- The scheme uses AiTM and device-code phishing to steal session tokens, bypassing MFA.
- Phishing domains mimic legitimate passkey and SSO setup pages to appear credible.
YubiKey 5C NFC Security Key — Phishing pages that harvest codes and session tokens fall flat against a hardware security key, since FIDO2 authentication is bound to the real site's domain. The YubiKey 5C NFC works over USB-C and NFC with Microsoft accounts, Google, and password managers, making it a practical upgrade for anyone tired of MFA prompts they can't trust.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-11
Published there as: “Passkey-themed phishing attacks lead to Microsoft 365 data theft”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.