Microsoft Security Research has published an account of cloud intrusions it has tracked since May 2026, and the opening move is a phone call about security.

Someone claiming to be from the company's IT helpdesk calls or texts an employee, often on a personal phone, and says a passkey, multi-factor authentication or single sign-on setting must be updated immediately or access will be lost. The link leads to a convincing copy of a Microsoft sign-in page.

Microsoft's central finding is that the passkey is the story, not the goal. The attackers are often not trying to enrol one at all. The passkey theme is a believable reason to walk someone through a different sign-in, one that can be captured.

Two ways in, neither of them a passkey

Microsoft describes two main routes.

  • A relayed sign-in. The fake page sits between the victim and Microsoft, passing the real sign-in through and capturing the password and the session token issued after multi-factor authentication. In one reconstructed timeline, the session completed MFA a minute after the first sign-in attempt, using a method that could be relayed.
  • A device-code approval. The victim is persuaded to type a short code into Microsoft's genuine device sign-in page. That approval issues a token to a client the attacker controls, which can then reach whatever the account can. No browser cookie is stolen, and the page the victim used really was Microsoft's.

In a third pattern, the attackers signed in with credentials compromised earlier, approving MFA through an authenticator app they appear to have registered days before the campaign began.

This is why the theme is clever. A passkey is bound to the real site, so it defeats the relay, but only if the account no longer accepts anything weaker. And a device-code approval takes place on the real site, where a passkey will complete it just as readily as a password would.

The evidence is on a phone nobody monitors

Microsoft is blunt about the investigative problem. When the link is opened on a personal phone that is not enrolled in the company's endpoint protection, the first stage leaves little or nothing in corporate telemetry. In many cases, it says, an employee's memory of a call or a text is the earliest evidence of how the breach began, and sometimes the only evidence.

The infrastructure is built for speed. The attackers register generic domains around themes such as passkeys, single sign-on, key synchronisation and account verification, then put the target company's name in front as a subdomain, so the address looks internal at a glance. Several domains may be made for one company, often through the registrar Nicenic, and they are live within hours. Microsoft stresses that registration there is not evidence of the registrar's involvement. In some cases the attackers used an already compromised account to send the same passkey message to colleagues on Microsoft Teams.

First job: an MFA method of their own

Once in, the attackers' priority is to turn a session into a foothold. They register an authentication method they control, such as a new phone number, an authenticator app or a software one-time-password token. In one sample log Microsoft published, the added token carries the device name NO_DEVICE. From then on, MFA prompts on that account can be answered without the victim.

Then Graph, then files

Next comes reconnaissance through Microsoft Graph: the tenant's licences and domains, users and groups, directory roles and registered authentication methods, applications and OAuth grants, SharePoint and OneDrive sites, and mailboxes. Each of those requests is ordinary on its own. The sequence is the signal, and the attackers rotate IP addresses between stages so the pieces do not line up by address.

Collection follows from SharePoint, OneDrive and, in some intrusions, Exchange Online through its REST interface, with the python-httpx user agent showing up in several cases. It is deliberately unhurried: fewer than 1,000 files or emails in any hour, over periods from several hours to days, to blend in with normal use.

As with the stolen session tokens we wrote about last week, MFA protected a login. It did not protect the session that came after it.

Who is behind it

Microsoft says the same initial-access technique is used by several actors in one extortion ecosystem. It names Storm-3121, whose access leads to ShinyHunters and Falcon extortion, and Storm-3032, a set of actors that split from the BlackFile group and now operate under the Helix name.

What to do

Microsoft's guidance, condensed:

  • Require phishing-resistant sign-in, meaning FIDO2 security keys, passkeys or Windows Hello for Business, through Conditional Access, and remove the weaker fallbacks. A passkey that is optional is optional for the attacker too.
  • Block the device-code and authentication-transfer flows unless there is a specific business need.
  • Lock down registration of new MFA methods: require a fresh interactive sign-in, a managed device or known location, and phishing-resistant strength, and block registration outright when sign-in risk is high.
  • Verify identity properly before any helpdesk-driven credential or MFA reset, alert on every such reset, and give staff a known channel to report unexpected authentication requests.
  • If an account is compromised, revoke sessions and refresh tokens, reset credentials, remove attacker-added methods and mailbox rules, and make the user re-register securely.
  • Limit unmanaged devices to web-only access without download or sync, and turn on Graph activity logging and mailbox auditing.

What is not established

  • How many organisations were breached, or which. Microsoft gives no count.
  • How much data was taken, and what extortion demands followed.
  • How the attackers obtain employees' personal phone numbers. Microsoft says they research targets through public social and professional profiles, but does not say where the numbers come from.
  • How often each route was used, relayed sign-in versus device code.
  • Whether particular leak-site claims by ShinyHunters or Helix trace back to this campaign.