Fake Passkey Updates Used to Hijack M365 Accounts

How the attack worked

Attackers posed as internal IT helpdesk staff and reached out to employees directly on their personal phones, either by call or text. The pretext centered on a supposed need to update a passkey, multifactor authentication method, or single sign-on setting, framed with urgency: employees were warned they could lose access if they did not act. This outreach method is notable because it bypasses monitored corporate channels, meaning organizations may have little visibility into the first point of contact.

Once an employee engaged, they were directed to a sign-in page designed to look like a legitimate Microsoft login screen. In some cases, the attackers included the organization's name in the web address to increase the appearance of legitimacy. Requests were also sometimes relayed through an already compromised employee's Teams account, adding a layer of apparent trust since the message came from a colleague.

Why it succeeded

Two separate technical paths allowed account takeover. In one, an attacker-controlled site relayed the sign-in attempt to Microsoft and captured both credentials and a session token after the employee completed an MFA check that was not phishing-resistant. In another, the employee entered a device code on Microsoft's real authentication page, and that action authorized an attacker-controlled client to receive a token. Both methods exploit trust in familiar-looking authentication steps rather than relying on stolen passwords alone.

After gaining access, attackers added authentication methods they controlled, such as a phone number, authenticator app, or software one-time password. This gave them a durable way to satisfy future login challenges even if the original compromise was detected.

What to watch for

• Unexpected calls or texts to a personal phone claiming to be from IT
• Urgent language warning of lost access unless settings are updated immediately
• Sign-in links that resemble Microsoft's login pages, even ones containing the organization's name
• Sign-in setting requests arriving through Teams chat rather than official IT channels
• Device code prompts appearing without the employee having initiated the sign-in themselves

Building resistance

Employees should verify any unexpected passkey, MFA, or SSO update request through a known, trusted IT channel rather than the number or link provided in the message. Organizations should consider requiring phishing-resistant MFA and restricting who can register new authentication methods, since attackers rely on adding their own methods to maintain access. Monitoring for new authentication method registrations and unusual device-code approvals can also help catch compromise attempts before attackers reach SharePoint, OneDrive, or Exchange Online data.

How did attackers trick employees into compromising their Microsoft 365 accounts?

Attackers called or texted employees' personal phones posing as IT helpdesk staff, warning they would lose access unless they updated a passkey, MFA, or SSO setting, then directed them to lookalike Microsoft sign-in pages.

What happened after attackers gained access to an account?

Attackers added their own authentication methods, such as a phone number, authenticator app, or software OTP, to maintain access, then searched and downloaded data from SharePoint, OneDrive, and sometimes Exchange Online email.

What is device-code phishing and why is it dangerous here?

In one case an employee entered a device code on Microsoft's real authentication page, and that step authorized an attacker-controlled client to receive a token, giving attackers access without needing to steal a password directly.

What can organizations do to reduce risk from these attacks?

Microsoft recommends requiring phishing-resistant MFA and restricting the registration of new authentication methods, along with training employees to verify unexpected sign-in setting requests through a trusted channel.