Microsoft has uncovered two coordinated phishing campaigns that exploit passkey themes and social engineering to hijack cloud accounts and steal data. These campaigns cleverly abuse trusted email delivery systems, impersonate executives, and leverage fake websites to fool victims, including bypassing multi-factor authentication.
Mass Email Scams Targeting Corporate Finance Teams
In the first campaign, which Microsoft tracked between August 3–5, 2026, attackers sent over a million scam emails. These emails posed as CEOs from target organizations and urged accounts payable departments to make Automated Clearing House (ACH) transfers for a fabricated ServiceNow subscription. Generative AI appears to have been used to craft convincing email templates tailored for different recipients and industries such as IT services, consumer goods, real estate, and discrete manufacturing. Scammers also registered spoofed domains and included doctored invoices and pretend correspondence to lend credibility to the request.
Passkey-Themed Intrusions That Slip Past MFA Defenses
The second campaign began in May 2026 and focuses on direct cloud-account takeovers. Attackers initiate social engineering tactics—calling or messaging users’ personal phones, claiming to be from IT, and pushing urgent passkey, single sign-on, or MFA updates to avoid account lockouts. Victims are then lured via SMS to counterfeit sign-in sites where attackers use advanced flows—such as adversary-in-the-middle or device-code authentication—to hijack their Microsoft accounts.
Once inside, threat actors take steps to establish persistence by registering their own MFA methods—often a phone number, authenticator app, or software one-time password—and then carry out reconnaissance, abuse Microsoft Graph APIs, extract emails and files from SharePoint, OneDrive, and Exchange, and spread throughout the organization. The attacks also exhibit infrastructure rotation to evade detection and often rely on behavior-based detection rather than isolated API calls.
Ties to Known Cybercrime Collectives & Shared Infrastructure
The operation bears hallmarks of several known cybercrime groups, including UNC6671 (also identified as Storm-3032), and overlap with other collective identities like Cordial Spider, PREY-0058, and O-UNC-045. These groups often share tools, phishing panels, voice-phishing techniques, domains, and affiliate-style structures. Microsoft also identified Storm-3121 in connection with earlier extortion operations, suggesting connections between financially-motivated campaigns and data theft attacks.
This campaign highlights a dangerous evolution: attackers are no longer just stealing credentials—they are harvesting persistent access via malicious MFA enrollment and using passkey-themed flows to cloak their actions. For defenders, it means identity security must shift from merely enforcing MFA to verifying enrollment processes, monitoring behavioral patterns across APIs like Microsoft Graph, and educating staff about targeted phishing. What organizations must watch for now is infrastructure reuse, domain typos mimicking internal systems, and any emergency MFA or passkey-reset communications arriving via personal phone numbers. Those subtle cues may be the biggest red flags yet.
