The Evolving Threat of Passkey-Themed Phishing Attacks

The New Frontier of Identity Theft: Passkey-Themed Phishing

While passkeys are celebrated for their phishing-resistant cryptographic properties, recent reports from Microsoft and security researchers highlight a critical evolution in social engineering tactics: passkey-themed phishing. Threat actors are successfully bypassing robust authentication mechanisms by exploiting human trust and manipulating enrollment processes, leading to significant enterprise cloud account takeovers and data exfiltration.

Beyond Protocol: Attacking the Human Element

Traditional phishing aims to trick users into revealing credentials. Passkeys, by design, prevent this by requiring cryptographic proof of identity tied to a specific device and origin. However, the latest attacks circumvent these technical safeguards by focusing on the enrollment or configuration of authentication methods, rather than the authentication event itself. Attackers impersonate IT help desk personnel, contacting employees via phone or message, and instructing them to "update a passkey, multi-factor authentication (MFA), or single sign-on (SSO) configuration" to avoid service disruption [6, 7].

Victims are then directed to sophisticated phishing sites that mimic legitimate login pages. While the lures mention passkeys, the goal isn't to enroll a genuine passkey. Instead, these are often adversary-in-the-middle (AiTM) phishing sites designed to capture session tokens or convince users to sign in, inadvertently giving the attacker control over their session [6]. Microsoft Security Research notes that this activity has been observed since at least May 2026, leading to a spike in identity and cloud compromises [8, 10].

The Anatomy of an Enterprise Account Takeover

The attack sequence typically follows several stages:

1. Reconnaissance: Threat actors research targeted organizations and their employees to tailor their social engineering approach.
2. Impersonation: Attackers pose as internal IT support, establishing a false sense of urgency and authority.
3. Vishing/Smishing: They initiate contact via phone (vishing) or SMS (smishing), directing employees to deceptive phishing sites.
4. Session Hijacking/Credential Theft: Victims are tricked into interacting with AiTM sites, where their session tokens are captured, or they are coaxed into providing sensitive information that allows the attacker to gain initial access.
5. Persistence and Privilege Escalation: Once an account is compromised, attackers often add their own MFA methods to maintain persistence, effectively locking out the legitimate user and hardening their access [7].
6. Data Exfiltration: The compromised identity is then used to access and exfiltrate sensitive data from cloud services like Microsoft Graph, SharePoint, OneDrive, and Exchange Online [7, 9].

This sophisticated approach demonstrates attackers