Microsoft warns of an active social engineering campaign where attackers pose as an IT help desk and pressure employees to “update” passkeys/MFA/SSO. Victims are sent to fake Microsoft sign-in pages or tricked into approving access via device-code login, enabling attackers to add their own MFA methods and quietly steal data from SharePoint, OneDrive, and Exchange.
This campaign starts with a message, by email or SMS, that impersonates a corporate IT help desk. The pretext is simple: a passkey, multifactor authentication, or single sign-on setting supposedly needs to be updated right away or the employee will lose account access. That urgency pushes the target toward a link that leads either to a fake Microsoft sign-in page or into a device-code authentication flow.
Both paths are dangerous in different ways. The fake sign-in pages act as adversary-in-the-middle phishing sites, capturing not just a password but the active session token, which can bypass normal MFA checks. The device-code flow is arguably more deceptive because it uses Microsoft's real authentication page. The user believes they are approving a routine sign-in, but they are actually authorizing an attacker-controlled application to access their account.
The scenario works because it borrows legitimacy from two directions at once: a trusted internal source (IT) and a trusted external one (Microsoft's own login pages or device-code system). Employees are conditioned to respond quickly to IT requests, especially ones framed around losing account access. Once inside, attackers commonly register their own phone number or authenticator app as a new MFA method. That step is what makes the intrusion durable: a password reset alone will not remove attacker access unless the added authentication method is also revoked and sessions and tokens are invalidated.
After initial access, attackers use Microsoft Graph to inventory users, groups, roles, applications, authentication methods, SharePoint sites, OneDrive files, and mailbox content. Data theft can be deliberately throttled to blend in with normal activity, and intrusions may persist for hours or multiple days before being noticed.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers pose as corporate IT and warn employees that a passkey, multifactor authentication, or single sign-on setting must be updated immediately or access will be lost, pushing them toward fake Microsoft sign-in pages or device-code authentication flows.
Attackers commonly register a phone number, authenticator app, or other MFA method they control, which can preserve access even after a password reset unless defenders remove the unauthorized methods and revoke active sessions and tokens.
Device-code phishing can trick a user into authorizing an attacker-controlled client through Microsoft's legitimate authentication page, meaning the victim believes they are approving something normal while granting an attacker access.
They use Microsoft Graph to inventory users, groups, directory roles, applications, authentication methods, SharePoint sites, OneDrive files, and mailbox content, and can throttle data theft to fewer than 1,000 files or emails per hour to avoid detection.
You get an email from “IT Help Desk”: update your Microsoft 365 passkey now or you’ll lose access. You click their link and land on what looks exactly like a Microsoft login. But it’s an adversary-in-the-middle page, quietly stealing your password and session so they can add their own MFA and stay in your account. From there, they register their own phone or authenticator app, then quietly pull files and emails from SharePoint, OneDrive, and Exchange using normal-looking Microsoft Graph activity. If you ever get an urgent passkey, MFA, or SSO update request, don’t touch the link, contact our IT using our internal help desk or chat and ask, "Did you really send this?"
Microsoft reports active intrusions where attackers trick employees with “passkey/SSO update” helpdesk pretexts delivered by phone, SMS, or even Microsoft Teams. Victims are sent to lookalike Microsoft sign-in pages or guided through device-code sign-in, letting attackers capture session access and…
Researchers described iAuthFlow v2, a phishing toolkit that steals a live Google login session and then uses that access to enroll an attacker-controlled passkey. Because passkeys are separate login methods, the attacker can often get back into the account even after the victim changes their…
Google says the BlackFile extortion group (UNC6671) rebranded to “Redact” while keeping the same core scam: phone calls that impersonate IT helpdesk staff and push “urgent security migrations.” Victims are directed to spoofed login pages that steal passwords and MFA codes, enabling attackers to…
Attackers broke into Brevo, the email platform Trezor uses for newsletters, and sent a phishing “security warning” from Trezor’s real mailing system. The email claimed a serious hardware issue could expose wallet recovery seeds and pushed people to a malicious site/app that asked for a wallet…
The bulletin describes real-world social engineering where staff were tricked into disclosing sensitive data or access. In one case, Revolut employees responded to fraudulent information requests sent from a real government-domain email account, exposing extensive customer records. Separately,…
Microsoft described two real-world campaigns: an invoice fraud blast impersonating executives to trick finance teams into ACH payments, and a passkey-themed helpdesk scam that steals or bypasses authentication to take over Microsoft cloud accounts. In the second campaign, victims are called or…
