Passkey Phishing Attacks: Fake Help-Desk Calls Leading to Microsoft 365 Data Theft

Part 5 of 8 in Recent Cyberattacks: Fall 2026 Briefings

On September 9, 2026, Microsoft Threat Intelligence described a campaign, observed since May 2026, in which attackers contact employees, often on their personal phones, pretending to be the IT help desk and urging a passkey, MFA or single sign-on update (Microsoft Threat Intelligence, Sept 9, 2026). Microsoft says the passkey story is usually a cover: the real goal is to capture a sign-in session, register the attacker’s own MFA method and quietly download files and email (Microsoft Threat Intelligence, Sept 9, 2026). No breach of Microsoft is involved; the attack targets how people and help desks handle sign-in requests.

Each item is linked to its source. Verification status reflects the strongest source available on the verification date.

What happened

1. Step 1. Attackers research employees and the organization chart from public professional sources (Microsoft Threat Intelligence, Sept 9, 2026).
2. Step 2. They call or text employees posing as IT and push an urgent passkey, MFA or SSO update (Microsoft Threat Intelligence, Sept 9, 2026).
3. Step 3. The employee is sent to a lookalike sign-in page or asked to enter a code on a real Microsoft page (device code phishing), handing over a session (Microsoft Threat Intelligence, Sept 9, 2026).
4. Step 4. The attacker registers their own phone, authenticator app or code generator as an MFA method (Microsoft Threat Intelligence, Sept 9, 2026).
5. Step 5. Using Microsoft Graph, they list users, groups and roles, then pull data from SharePoint, OneDrive and Exchange slowly to avoid notice, followed by possible extortion (Microsoft Threat Intelligence, Sept 9, 2026).

Related cases that organizations have confirmed

Security firm ReliaQuest confirmed that in August 2026 an attacker phoned employees posing as its security team; one employee entered credentials on a fake sign-in page and approved an MFA push, but device-trust controls kept the attacker to view-only access, and ReliaQuest says no customer data was accessed (BleepingComputer on ReliaQuest). ReliaQuest’s account shows how a managed-device requirement can limit the damage when a password and MFA approval are given away.

Cook Medical said in August 2026 that an employee was deceived by a social-engineering attack in July, giving an outside party access to certain systems; Cook says it contained the incident the same day and found no evidence sensitive data was accessed (MedTech Dive on Cook Medical). Cook has not named an attacker, and Microsoft does not link Cook or ReliaQuest to its report.

Health-ISAC’s chief security officer told Cybersecurity Dive that more than a dozen member organizations had been hit by voice-phishing attacks, which Health-ISAC linked to ShinyHunters (Cybersecurity Dive).

What is still unknown

What Microsoft recommends

Microsoft’s report lists specific controls (Microsoft Threat Intelligence, Sept 9, 2026). In plain terms:

1. Use phishing-resistant MFA (passkeys/FIDO2, Windows Hello for Business), enforced with Conditional Access (Microsoft Threat Intelligence, Sept 9, 2026).
2. Require a managed, compliant device to reach Exchange, SharePoint and high-privilege apps (Microsoft Threat Intelligence, Sept 9, 2026).
3. Protect MFA registration itself: require re-authentication and a trusted device or location to add a new method, and alert when one is added (Microsoft Threat Intelligence, Sept 9, 2026).
4. Block the device code flow unless there is a documented business need (Microsoft Threat Intelligence, Sept 9, 2026).
5. Have the help desk verify identity rigorously before any password or MFA reset, and alert on every reset (Microsoft Threat Intelligence, Sept 9, 2026).
6. Restrict user consent to apps, review apps with broad Microsoft Graph permissions, and turn on Graph activity and mailbox audit logs (Microsoft Threat Intelligence, Sept 9, 2026).
7. Train staff on phone and email phishing that targets MFA and passkey enrollment, and give them a verified way to report unexpected sign-in requests (Microsoft Threat Intelligence, Sept 9, 2026).

More in this series

See all briefings and their verification status in the recent cyberattacks and data breaches tracker.

Sources

1. Microsoft Security Blog, September 9, 2026. https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/
2. BleepingComputer, August 24, 2026. https://www.bleepingcomputer.com/news/security/reliaQuest-confirms-failed-data-theft-attack-after-shinyhunters-breach/
3. MedTech Dive, August 13, 2026. https://www.medtechdive.com/news/cook-medical-discloses-cyber-incident-stemming-from-a-scam/827847/
4. Cybersecurity Dive, September 25, 2026. https://www.cybersecuritydive.com/news/threat-groups-social-engineering-attacks-healthcare/831383/