The Nuance of Passkey Attacks: Social Engineering & Persistence

The Nuance of Passkey Attacks: Beyond Phishing Resistance

Passkeys have rapidly gained traction as a robust, phishing-resistant authentication method, designed to relegate password-based vulnerabilities to history. However, recent campaigns detailed by Microsoft Security Research, BleepingComputer, and CSO Online reveal a sophisticated evolution in attack methodologies that target not the cryptographic strength of passkeys, but the human element and implementation workflows surrounding them. These "passkey-themed" social engineering attacks successfully compromise Microsoft 365 accounts, leading to persistent access and data exfiltration, underscoring a critical need for enterprises to re-evaluate their identity security postures.

The Evolving Attack Vector: Social Engineering as the New Gateway

The fundamental premise of passkeys is their cryptographic binding to a specific origin, making traditional phishing sites ineffective. Attackers can't simply harvest credentials as they would with passwords. The latest campaigns, however, demonstrate a shift towards leveraging social engineering to trick users into authenticating on attacker-controlled devices or through compromised workflows. This isn't a flaw in the FIDO2 protocol itself, but rather a sophisticated bypass of the user's understanding and organizational security protocols.

Microsoft Security Research detailed a series of active cloud intrusions, observed since May 2026, where threat actors are employing highly organized social engineering tactics. These attacks often begin with meticulous reconnaissance of targeted organizations and employees, gathering information such as their roles and even personal phone numbers. Source: Microsoft Security Blog

Anatomy of a Passkey-Themed Social Engineering Attack

Attackers typically initiate contact by impersonating corporate IT help desks, reaching out via phone calls or messages to employees' personal devices. The pretext is often urgent: employees are told they must immediately update a passkey, multi-factor authentication (MFA), or single sign-on (SSO) configuration to prevent loss of access to critical corporate systems. Source: BleepingComputer

Victims are then directed to what appear to be legitimate Microsoft login pages, often delivered via SMS links. Crucially, these are adversary-in-the-middle (AiTM) phishing sites or involve device-code authentication flows where the user inadvertently authorizes the attacker's device. As Jon Baker, VP of Threat-Informed Defense at AttackIQ, aptly notes, "The passkey in this campaign is the lure, not the weakness. The MFA that got bypassed was phishable. Real passkeys would have stopped it." Source: CSO Online

What makes these attacks particularly insidious is that the attackers are not attempting to enroll a passkey for the victim. Instead, the "passkey" theme is a psychological tactic, a social engineering lure designed to induce a sense of urgency and legitimacy, coercing the employee into unwittingly granting access via other phishable means.

Achieving Persistence and Exfiltration

Once an employee falls victim, the attackers gain access to the compromised cloud identity. This initial breach is rapidly leveraged to establish persistence within the victim's Microsoft 365 environment. Observed post-compromise activities include:

• Adding attacker-controlled authentication methods: This ensures continued access even if the original compromised session expires or is detected.
• High-volume Microsoft Graph activity: Indicating extensive reconnaissance and enumeration of the environment.
• SharePoint and OneDrive downloads: Direct exfiltration of sensitive documents and files.
• Email collection through REST APIs: Accessing and potentially exfiltrating communication history and further sensitive information.

This sequence of events highlights a clear objective: establish a foothold, expand access, and exfiltrate data, all while bypassing the intended security benefits of modern authentication methods.

Enterprise Defenses: A Multi-Layered Approach

Protecting against these sophisticated attacks requires a comprehensive strategy that addresses technical controls, user education, and continuous monitoring. Enterprises must assume that the human element remains a primary target, even with advanced authentication:

• Strengthen Phishing-Resistant MFA: While passkeys offer inherent phishing resistance, ensure that any fallback or alternative MFA methods (e.g., authenticator app push notifications) are also as resistant as possible. Implement strict policies to prevent enrollment of less secure methods.
• Advanced User Education and Awareness: Train employees to recognize social engineering tactics, particularly those involving urgent requests from "IT help desks." Emphasize that legitimate IT support will not request authentication via external links or personal devices.
• Conditional Access Policies: Implement robust conditional access rules that restrict sign-ins based on location, device health, compliance, and application. This can prevent attackers from using compromised credentials from unauthorized environments.
• Continuous Monitoring and Alerting: Employ advanced threat detection capabilities to identify unusual sign-in patterns, rapid enrollment of new authentication methods, high-volume data access (especially from new IP addresses or regions), and suspicious API activity within cloud environments like Microsoft 365.
• Zero Trust Principles: Adopt a Zero Trust framework, continuously verifying identity and device posture, and granting least-privilege access. Assume breach and enforce granular authorization for all access requests.
• Secure Device Management: Ensure endpoints are secure and compliant. Compromised devices can become gateways for persistent access, even with strong identity controls.

These passkey-themed social engineering campaigns serve as a critical reminder that cybersecurity is a perpetually evolving landscape. While foundational technologies like passkeys enhance security significantly, the ingenuity of attackers demands equally dynamic and adaptive defense strategies focused on the entire identity lifecycle and the ever-present human factor.