Passkey Social Engineering: A New Threat to Enterprise M365 Security

The Evolving Threat: Passkey-Themed Social Engineering

Passkeys promise a future of phishing-resistant authentication, significantly enhancing enterprise identity security. However, recent reports from Microsoft Security Research indicate a concerning trend: attackers are now weaponizing the very concept of passkeys through sophisticated social engineering campaigns to compromise Microsoft 365 accounts and exfiltrate sensitive data. This new vector underscores that while the technology is robust, the human element remains a critical vulnerability.

The Attack Vector: Impersonation and Urgency

Threat actors, often linked to well-known extortion groups, are employing tactics that exploit employees' growing familiarity with passkeys and the imperative for strong authentication. The attacks typically unfold through a series of steps:

1. Reconnaissance: Attackers research target organizations and their employees to tailor their social engineering attempts.
2. Impersonation: They initiate contact via phone calls, SMS messages, or even Microsoft Teams, impersonating legitimate IT helpdesk staff [6].
3. Urgency and Deception: Employees are told they must urgently update or enroll a passkey, multi-factor authentication (MFA), or single sign-on (SSO) configuration to prevent a loss of access [7].
4. Phishing Lure: Victims are directed to adversary-in-the-middle (AiTM) phishing sites or instructed to use device-code authentication flows, often via links sent to personal devices [9]. These pages are meticulously crafted to resemble legitimate Microsoft login portals.

Crucially, the attackers are not attempting to enroll a passkey themselves. Instead, the passkey reference serves as a convincing lure to trick employees into divulging credentials or session tokens through AiTM attacks, or to authorize access via device code flows [8]. This allows threat actors to bypass traditional MFA protections that might otherwise resist phishing.

Post-Compromise: Persistence and Data Exfiltration

Once an account is compromised, attackers move swiftly to establish persistence and expand their access. Microsoft has observed the following post-compromise activities:

• Authentication Method Registration: Attackers register their own authentication methods to maintain access, even if the victim changes their password [9].
• Environment Mapping: They map the victim’s Microsoft 365 environment to identify valuable assets.
• Data Access and Exfiltration: Compromised identities are used to access and exfiltrate sensitive data from services like SharePoint, OneDrive, Exchange Online, and Microsoft Graph [10].

This highlights a critical point: while passkeys are designed to be phishing-resistant at the cryptographic layer, the implementation and user experience around passkey enrollment and management can be exploited through social engineering. As Jon Baker, VP of Threat-Informed Defense at AttackIQ, aptly puts it, "The passkey in this campaign is the lure, not the weakness. The MFA that got bypassed was phishable. Real passkeys would have stopped it" [7].

Enterprise Defenses Against Passkey Social Engineering

Defending against these evolving threats requires a multi-layered approach that combines technical controls with robust security awareness and proactive identity management practices.

Strengthen Identity Governance and Monitoring

• Monitor Authentication Changes: Implement stringent monitoring and alerting for unusual authentication method registrations, especially those initiated outside of typical IT processes. Track device code sign-ins, which are increasingly targeted.
• Unusual Cloud Data Access: Monitor for high-volume Microsoft Graph activity, unusual SharePoint/OneDrive downloads, and email collection via REST APIs. Anomalous behavior should trigger immediate investigation.
• Conditional Access Policies: Leverage Conditional Access to enforce strict controls based on user, device, location, and application. For example, block sign-ins from unmanaged devices or unusual geographic locations.

Enhance Employee Awareness and Training

• Targeted Training: Educate employees about passkey adoption and management, but critically, also about the social engineering tactics attackers are using. Explain that legitimate passkey setup or updates will never involve unsolicited calls or urgent requests for credentials outside of official channels.
• Recognize Impersonation: Train users to verify the identity of anyone requesting sensitive information or system changes, especially those claiming to be from IT support. Emphasize that IT will not ask for passwords or direct users to suspicious links for authentication updates.
• Report Suspicious Activity: Foster a culture where employees feel empowered to report suspicious communications without fear of reprisal.

Implement Advanced Authentication Strategies

• Phishing-Resistant MFA (True Passkeys): Accelerate the deployment of true phishing-resistant authentication methods, such as FIDO2 security keys or device-bound passkeys, across all critical enterprise applications. Emphasize that these methods inherently resist AiTM attacks.
• Adaptive Authentication: Implement adaptive authentication that assesses risk in real-time and requires additional verification for high-risk sign-in attempts.

Conclusion

The passkey-themed social engineering campaigns highlight the persistent challenge of securing the human element in an increasingly complex threat landscape. While passkeys offer a significant leap forward in authentication security, their effectiveness is only as strong as the processes and user understanding surrounding them. Enterprise security teams must proactively address this evolving threat by bolstering monitoring capabilities, enhancing user education, and accelerating the adoption of truly phishing-resistant authentication methods to secure their Microsoft 365 environments against these sophisticated attacks. The goal is not just to implement strong authentication, but to ensure users cannot be tricked into undermining it. "