Passkey Social Engineering: The Evolving Threat to Enterprise Identity

The New Frontier of Identity Attacks: Passkey-Themed Social Engineering

Recent reports from Microsoft Security Research highlight a critical and evolving threat to enterprise identity: passkey-themed social engineering attacks. While passkeys are heralded as a significant leap forward in phishing resistance, threat actors are adapting their tactics, weaponizing the concept of passkeys to bypass traditional multi-factor authentication (MFA) and compromise cloud environments. This development underscores the continuous cat-and-mouse game in cybersecurity, where even advanced security measures become fodder for sophisticated social engineering. Enterprise security architects, CISOs, and IAM engineers must understand these nuanced attacks to build resilient defense strategies.

The Attack Vector: Deception Masquerading as Security

The core of these attacks lies in sophisticated social engineering. Threat actors impersonate IT helpdesk staff, contacting employees via phone calls or SMS messages, often on personal devices. The pretext is urgent: employees need to "update" or "enroll" a passkey, or reconfigure MFA/SSO settings to avoid losing access to corporate systems. This urgency, combined with the perceived legitimacy of an IT support request, pushes victims towards compromise [6].

Crucially, the attackers are not exploiting flaws in the FIDO2 passkey protocol itself. Instead, they are using the idea of passkeys as a lure. Victims are directed to meticulously crafted phishing sites designed to mimic legitimate Microsoft login pages. These sites are typically adversary-in-the-middle (AiTM) proxies or exploit device-code authentication flows [7].

Once a victim enters their credentials or authorizes access through the device code, the attackers gain access to their session tokens or directly authorize their attacker-controlled application. This allows them to bypass even strong MFA mechanisms that would otherwise protect the account. The "passkey" is merely a deceptive theme, a psychological lever used to manipulate users into surrendering their authentication credentials or approving unauthorized access.

Anatomy of a Cloud Compromise

The consequences of these social engineering attacks are severe and far-reaching for enterprises, particularly those heavily reliant on Microsoft 365 services. Microsoft’s reports detail a consistent attack chain observed since May 2026, leading to significant cloud compromise [6, 7]:

• Initial Access & Credential Harvesting: The social engineering phase captures user credentials or session tokens via AiTM phishing sites or device-code scams. The attackers often research targeted organizations and employees beforehand, making their impersonation more convincing.
• Persistence Establishment: Once initial access is gained, threat actors immediately establish persistence. This typically involves adding unauthorized authentication methods to the compromised user