Microsoft reports active intrusions where attackers trick employees with “passkey/SSO update” helpdesk pretexts delivered by phone, SMS, or even Microsoft Teams. Victims are sent to lookalike Microsoft sign-in pages or guided through device-code sign-in, letting attackers capture session access and then add their own MFA method for persistence. After that, the attackers use Microsoft Graph to enumerate and collect email and files from SharePoint and OneDrive.
This intrusion pattern starts with a helpdesk impersonation call or text sent to an employee's personal phone number, not a work line. The caller claims a passkey, MFA, or SSO configuration must be updated immediately to avoid disruption, creating urgency that discourages the victim from pausing to verify. Employees are then directed to a website that closely resembles a legitimate Microsoft sign-in experience, or they are talked through a device-code authentication flow. In device-code phishing, the victim enters a code on the real Microsoft authentication page, and that approval issues a token to an attacker-controlled client. In a smaller number of cases, attackers use already compromised employee accounts to send the same passkey-themed lure through Microsoft Teams, which increases trust because the message appears to come from a coworker.
The pretext works because it borrows language employees already associate with legitimate security hygiene: passkeys, MFA, and SSO updates. Combining that with urgency and a call to a personal phone bypasses normal IT communication channels where a scam might otherwise be caught. The lookalike sign-in domains, sometimes structured as a generic domain with the target company's name embedded as a subdomain, add a visual layer of legitimacy that a quick glance will not catch.
Employees should verify any helpdesk contact through a known internal number before acting on urgent authentication requests, and never approve a device code or sign-in prompt they did not start themselves. After any suspected phishing, IAM and cloud admin teams should review accounts for newly added authentication methods, since attackers in this pattern register their own phone number, authenticator app, or OTP token to persist access, and revoke sessions for confirmed compromises.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It begins with a call or message on an employee's personal phone from someone claiming to be IT helpdesk, warning that a passkey, MFA, or SSO setting must be updated immediately to avoid disruption.
Victims are sent to a website that closely resembles a legitimate Microsoft sign-in page or are guided through device-code authentication, which lets the attacker capture a valid session or token.
In some cases attackers use already compromised accounts to send the same passkey-themed messages through Teams, making the request appear legitimate and increasing the likelihood employees will engage.
Instead of relying only on stolen credentials, attackers enroll their own MFA method, such as a new phone number, authenticator app, or software OTP token, so they retain access even if the password is later reset.
You get a call or text on your personal phone: “IT helpdesk here, we need to update your Microsoft passkey right now or your access breaks.” They text you a link that looks like Microsoft, or even send it over Microsoft Teams from a coworker’s compromised account. You land on a sign-in page that resembles Microsoft 365, or they walk you through entering a device code on the real Microsoft site. Here’s the trap: that passkey story is just a pretext. When you sign in or enter that device code, you’re approving a session for them. They add their own phone or authenticator as MFA, then quietly pull mail, SharePoint, and OneDrive data through Microsoft Graph. If anyone asks you to update passkeys or enter a device code you didn’t start, hang up, ignore the link, and call our real helpdesk using the number on the intranet.
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
This news roundup describes real social-engineering operations where attackers impersonate trusted support teams to trick people into giving up secrets. One campaign uses email/SMS/WhatsApp plus AI voice calls pretending to be Apple Support to steal iPhone passcodes, while another uses phishing…
This recap describes multiple real-world social-engineering-driven attacks, including vishing calls that push employees to spoofed login pages and a supply-chain trick where cloning/opening a GitHub repo in developer tools triggers malware. It also highlights an unusual case where an AI model…
Google says the BlackFile extortion group (UNC6671) rebranded to “Redact” while keeping the same core scam: phone calls that impersonate IT helpdesk staff and push “urgent security migrations.” Victims are directed to spoofed login pages that steal passwords and MFA codes, enabling attackers to…
UNC6671 is running real-world voice phishing (vishing) campaigns where callers impersonate IT help desk staff and create urgency around “mandatory” security changes. Victims are pushed to spoofed login pages that capture passwords and MFA codes, enabling attackers to access and steal data from SaaS…
Okta says it gained an inside look at “Work Panel,” a polished SaaS-style dashboard that helps voice-phishing (vishing) crews rapidly set up fake login sites and guide victims through password and MFA capture. The tool clones brand look-and-feel for services like Okta and Microsoft 365, then lets a…
