Attackers Hijack Microsoft Cloud Accounts via Passkey Phishing

Microsoft has disclosed two coordinated campaigns that target its cloud services by leveraging passkey‑phishing techniques. Between August 3 and 5 2026, more than one million fraudulent emails were sent through third‑party delivery platforms, masquerading as chief executive officers to lure recipients into a passkey enrollment flow that ultimately hands control of Azure identities to threat actors. The campaigns also include a second wave that uses compromised email infrastructure to distribute financial‑fraud scams while simultaneously probing for cloud credentials.

The core of the attack exploits the recent shift toward password‑less authentication. Passkeys, stored in device‑bound secure enclaves, are presented to the relying party via a standardized WebAuthn ceremony. By crafting a convincing phishing page that mimics Microsoft’s sign‑in UI, the attackers capture the cryptographic response generated by the victim’s authenticator. Because the response is bound to the relying party’s domain, the malicious page must be hosted on a domain that resolves to a Microsoft‑controlled endpoint or be able to perform a domain‑relaying attack. In the reported incidents, the adversaries leveraged compromised third‑party email services to host the phishing pages, thereby bypassing traditional domain‑based defenses.

Successful completion of the flow grants the attacker a valid passkey credential linked to the victim’s Azure Active Directory (AAD) account. With that credential, the threat actor can bypass password‑based multi‑factor authentication, acquire OAuth tokens, and access a broad set of Azure resources, including storage accounts, virtual machines, and confidential data repositories. Microsoft’s internal telemetry indicates that at least several dozen accounts were fully compromised, leading to the exfiltration of proprietary files and the creation of new service principals for persistent access.

Mitigation Recommendations

Enterprises should treat passkey‑phishing as a high‑severity credential‑theft vector. Immediate steps include: (1) enforce conditional access policies that require additional verification for high‑risk sign‑in locations or devices, even when a valid passkey is presented; (2) disable passkey authentication for privileged or service accounts until the threat landscape stabilizes; (3) deploy Microsoft Defender for Cloud Apps to monitor anomalous credential usage and generate alerts on newly created service principals; (4) tighten email security by enabling DMARC enforcement, SPF alignment, and DKIM signing on all inbound mail, and by leveraging Microsoft Defender for Office 365 safe links and anti‑phishing policies; (5) educate users about the visual cues of legitimate Microsoft sign‑in pages, emphasizing that passkey enrollment should only occur through trusted Microsoft portals.

Detection can be improved by logging WebAuthn authentication events in Azure AD sign‑in logs and correlating them with unusual IP geographies or device identifiers. Security teams should also audit the list of registered passkeys for each account on a regular cadence, revoking any that are not recognized. For compromised accounts, initiate an immediate password reset, revoke all active refresh tokens, and rotate any associated service principal secrets. Microsoft has released a guidance document that outlines the steps to invalidate all passkey credentials for a tenant, which can be executed via PowerShell or the Azure portal.

The broader implication of these campaigns is a reminder that password‑less adoption does not eliminate social engineering risk. While passkeys remove the need for static passwords, the credential‑generation ceremony remains a user‑controlled interaction point that can be spoofed. Organizations planning to expand password‑less deployments should pair the technology with robust phishing‑resistant verification methods, such as hardware‑based security keys that enforce origin binding, and maintain a layered defense strategy that includes email authentication, continuous monitoring, and rapid incident response. By applying the mitigations outlined above, enterprises can reduce the attack surface and limit the potential impact of future passkey‑phishing attempts.