Passkey Social Engineering: The Next Evolution of Identity Attacks

The Evolving Landscape of Identity Compromise

Passkeys promise a significant leap forward in authentication security, largely mitigating traditional phishing attacks that rely on stealing passwords. However, recent observations from Microsoft Security Research indicate that threat actors are rapidly adapting, leveraging passkey adoption as a new vector for sophisticated social engineering campaigns and adversary-in-the-middle (AiTM) phishing.

These evolving tactics highlight a critical challenge for enterprise security: while the underlying cryptography of passkeys remains robust, the human element and implementation vulnerabilities present persistent attack surfaces. Security architects and IAM engineers must understand these new threats to fortify their organizations against the next generation of identity compromise.

The New Threat Model: Passkey-Themed Social Engineering

Traditional phishing typically involves tricking users into entering credentials on a malicious site. Passkeys, by design, are resistant to this. They are cryptographically bound to specific origins, preventing their use on impostor sites. However, attackers are now weaponizing the concept of passkeys itself, exploiting user unfamiliarity and the perceived urgency of security updates.

Microsoft has detailed active cloud-based intrusions observed since May 2026 where attackers initiate contact through phone calls or messages, impersonating corporate IT help desks. The pretext is often an urgent need to "update" or "configure" passkeys, multi-factor authentication (MFA), or single sign-on (SSO) settings to avoid service disruption. BleepingComputer also reported on these campaigns, noting the attackers’ focus on Microsoft 365 environments.

Crucially, these campaigns do not aim to enroll a fraudulent passkey. Instead, the passkey theme serves as a convincing lure to direct victims to sophisticated AiTM phishing sites. These sites act as proxies, relaying authentication requests between the victim and the legitimate service. When a user attempts to "update" their passkey on such a site, the attacker captures session tokens or other authentication artifacts, effectively bypassing even phishing-resistant MFA.

Key Characteristics of These Attacks:

• Pre-attack reconnaissance: Threat actors perform extensive research on target organizations and employees to tailor their social engineering approach, often gathering job titles, departments, and personal phone numbers.
• Impersonation: Attackers convincingly impersonate internal IT support, leveraging the trust users place in official communications.
• Urgency and fear tactics: Victims are pressured with warnings of imminent account lockout or service loss to bypass critical thinking.
• AiTM phishing: The technical execution involves proxying legitimate authentication flows, stealing session cookies or tokens in real-time.
• Post-compromise actions: Once access is gained, attackers rapidly add new authentication methods for persistence, conduct reconnaissance within cloud environments, and exfiltrate sensitive data from services like SharePoint, OneDrive, and Exchange Online.

Implications for Enterprise CIAM and PKI

While passkeys represent a significant improvement over passwords, their efficacy is contingent on secure implementation and user education. These attacks underscore several critical implications for enterprise identity and access management:

The Continued Importance of Cryptographic Agility and PKI Hygiene

Though not directly a PKI compromise, the ability of attackers to manipulate authentication flows highlights the broader need for strong cryptographic foundations. Secure certificate management and agile PKI practices ensure that legitimate communication channels are protected and that any compromise can be rapidly identified and remediated. Organizations must ensure that all authentication endpoints and associated services are secured with robust, well-managed certificates.

Strengthening the Human Firewall

The most advanced security technologies can be undermined by effective social engineering. Enterprises must invest in continuous and targeted security awareness training that specifically addresses evolving phishing techniques, including those that leverage passkey-themed lures. Employees need to be educated on:

• How legitimate passkey enrollment/management processes work.
• The dangers of unexpected requests to "update" security settings.
• Verification procedures for suspicious IT communications.
• The limitations of passkeys (e.g., they prevent phishing by binding to specific sites, not by magically making all requests safe).

Robust CIAM and Identity Governance

Effective Customer Identity and Access Management (CIAM) strategies must account for these new attack vectors. This includes:

• Conditional Access Policies: Implementing policies that restrict access based on device health, location, and behavioral analytics.
• Continuous Authentication: Moving beyond one-time authentication to continuously verify user identity and session integrity.
• Real-time Threat Detection: Enhancing monitoring for unusual sign-ins, rapid addition of new authentication methods, and anomalous API activity post-authentication. This is critical for detecting the initial stages of these attacks.
• Zero Trust Principles: Applying least privilege and continuous verification to all access requests, even after initial authentication.

Mitigating the Risk: Actionable Steps for Security Teams

To counter these sophisticated threats, enterprises should adopt a multi-layered defense strategy:

1. Reinforce Phishing-Resistant MFA: While AiTM attacks can bypass some MFA, leveraging FIDO2-based security keys (which passkeys often rely on) for critical systems remains a best practice. Ensure that even when users are lured to fake sites, their FIDO2 credentials cannot be used to authenticate with the legitimate service.
2. User Education: Implement targeted campaigns explaining the true benefits and limitations of passkeys and how to identify social engineering attempts. Emphasize that legitimate passkey operations are typically initiated by the user on a trusted device, not by an unsolicited call or message.
3. Advanced Endpoint Protection: Deploy Endpoint Detection and Response (EDR) solutions to detect malicious activity on endpoints, which can indicate a compromised session even if the authentication mechanism itself was not directly broken.
4. Strengthen Cloud Security Posture: Configure robust logging and alerting for anomalous activities in cloud environments, such as unexpected MFA changes, new device enrollments, or unusual data access patterns.
5. Review Incident Response Plans: Update incident response playbooks to specifically address identity compromise scenarios involving social engineering and AiTM phishing, focusing on rapid session invalidation and credential revocation.
6. Regular Audits: Conduct regular audits of authentication policies, user privileges, and configuration settings within CIAM and PKI environments to identify and remediate potential weaknesses.

Conclusion

Passkeys represent a significant step towards a passwordless future and enhanced security, but they are not a silver bullet against all forms of identity compromise. The emergence of passkey-themed social engineering and AiTM attacks underscores a fundamental truth in cybersecurity: as defenses evolve, so do attack methods. For enterprise security teams, continuous adaptation, comprehensive user education, and a robust CIAM framework built on Zero Trust principles are essential to protect against these increasingly sophisticated threats. The focus must shift beyond just securing the authentication mechanism to securing the entire authentication process and the user's interaction with it. Organizations must establish certificate operations as a permanent enterprise capability and prioritize cryptographic agility as seen in PQC Migration Framework 3.0 to remain resilient against future cryptographic changes and evolving identity threats.