Passkey Phishing Attacks Target Microsoft 365 and Azure AD to Exfiltrate Corporate Data

Executive Summary

Recent months have witnessed a significant escalation in the use of passkey phishing techniques by advanced threat actors to compromise Microsoft Cloud accounts, including Microsoft 365, Azure Active Directory (Entra ID), SharePoint Online, OneDrive for Business, and Exchange Online. These campaigns exploit the growing adoption of passwordless authentication and multi-factor authentication (MFA) by leveraging social engineering, adversary-in-the-middle (AiTM) phishing, and device code abuse. Attackers are able to hijack user identities, establish persistent access, and exfiltrate sensitive corporate data at scale. Attribution points to groups such as Storm-3121 (linked to ShinyHunters and Falcon extortion) and Storm-3032 (associated with Helix extortion, formerly BlackFile), as well as other e-crime collectives. The sophistication of these attacks, including rapid infrastructure rotation and the abuse of legitimate authentication flows, presents a formidable challenge to traditional detection and response mechanisms.

Threat Actor Profile

The primary actors behind these campaigns are Storm-3121 and Storm-3032, both of which have established reputations for high-impact extortion and data theft operations. Storm-3121 is closely linked to the ShinyHunters and Falcon extortion brands, known for targeting enterprise cloud environments and leveraging stolen data for double extortion. Storm-3032, previously operating as BlackFile and now rebranded as Helix, has splintered from its original group but continues to employ similar tactics, techniques, and procedures (TTPs). These actors are part of a broader e-crime ecosystem, sharing infrastructure, phishing kits, and operational playbooks. Their campaigns are characterized by highly targeted reconnaissance, the use of generative AI for crafting convincing lures, and the rapid adaptation of new authentication technologies such as passkeys and device code flows.

Technical Analysis of Malware/TTPs

The attack chain typically begins with social engineering, where attackers impersonate IT helpdesk personnel and contact targets via phone, SMS, or email. The pretext involves urgent requests to update or enroll in passkey, MFA, or SSO (Single Sign-On) systems. Victims are directed to phishing sites that closely mimic legitimate Microsoft login portals, often using domains that incorporate the target organization’s name for added credibility (e.g., contoso.add-passkey[.]com). These phishing sites employ AiTM techniques to intercept credentials and session tokens or abuse the device code authentication flow, tricking users into authorizing attacker-controlled devices.

Once initial access is achieved, attackers enumerate the environment using the Microsoft Graph API, mapping users, groups, roles, and applications. They often register new MFA methods—such as phone numbers, authenticator apps, or OTP generators—to establish persistence. This allows continued access even if the victim resets their password. Lateral movement is facilitated through compromised accounts, with attackers using Microsoft Teams and other collaboration tools to phish additional users within the organization.

Data collection and exfiltration are highly automated. Attackers leverage the python-httpx user agent to script high-volume downloads from SharePoint, OneDrive, and Exchange Online. Exfiltration is designed to blend with normal user activity, often occurring over extended periods and using multiple IP addresses to evade detection. Infrastructure is rotated frequently, with separate IPs used for authentication, reconnaissance, and data theft phases.

Key technical indicators include phishing domains such as passkeyhelpdesk[.]com, secure-passkey[.]com, setupmypasskey[.]com, and add-passkey[.]com, as well as the presence of the python-httpx user agent in cloud access logs.

Exploitation in the Wild

Since May 2026, these campaigns have been observed targeting a wide range of sectors, including IT services, consumer goods, real estate, discrete manufacturing, and enterprise users, with a particular focus on organizations in the United States. Attackers employ personalized social engineering, often using information gathered from public sources like LinkedIn and company websites to craft convincing lures. Compromised accounts are sometimes used to propagate phishing within the organization via Microsoft Teams.

The attackers’ use of rapid infrastructure rotation makes detection and blocking challenging. Persistence is commonly achieved by registering attacker-controlled MFA methods, which can survive password resets and other remediation efforts. Data exfiltration is automated, sustained, and often indistinguishable from legitimate user activity, complicating incident response and forensic analysis.

Victimology and Targeting

Victims span multiple industries, with a notable concentration in sectors that rely heavily on Microsoft Cloud services for daily operations. The primary targets are organizations with large user bases and valuable intellectual property or sensitive customer data stored in SharePoint, OneDrive, or Exchange Online. Attackers prioritize users with elevated privileges, such as administrators and executives, but also target regular employees to establish a foothold and facilitate lateral movement.

The campaigns are highly targeted, with attackers conducting detailed reconnaissance to identify key personnel and tailor their phishing lures accordingly. The use of generative AI enables the creation of highly convincing emails, SMS messages, and even voice calls, increasing the likelihood of successful compromise.

Mitigation and Countermeasures

Organizations should implement a multi-layered defense strategy to mitigate the risk posed by passkey phishing campaigns. Key recommendations include enforcing strong MFA policies and monitoring for changes to authentication methods, particularly the registration of new devices or phone numbers. Conditional access policies should be configured to restrict access from unmanaged devices and unfamiliar locations.

User education is critical—employees must be trained to recognize social engineering tactics and the signs of phishing related to passkey and MFA enrollment. Regular audits of MFA devices and sessions should be conducted, with unused or suspicious entries promptly revoked. Security teams should leverage threat intelligence feeds to block known phishing domains and monitor for the presence of suspicious user agents such as python-httpx in cloud access logs.

Detection can be enhanced by correlating identity, authentication, and cloud workload signals. The following Kusto queries can assist in hunting for malicious activity:

To detect new MFA device registration:

CloudAppEvents
| where ActionType == "Update user."
| where tostring(RawEventData.ResultStatus) == "Success"
| where RawEventData has_any ("StrongAuthenticationPhoneAppDetail", "StrongAuthenticationUserDetails")
| extend AccountObjectId = extract(@"User_([a-f0-9\-]+)", 1, tostring(RawEventData.Target))
| where isnotempty(AccountObjectId)
| mvexpand ModifiedProp = RawEventData.ModifiedProperties
| where tostring(ModifiedProp.Name) in ("StrongAuthenticationPhoneAppDetail", "StrongAuthenticationUserDetails")
| extend OldValue = tostring(ModifiedProp.OldValue), NewValue = tostring(ModifiedProp.NewValue)
| extend OldDeviceCount = countof(OldValue, @"""Id"""), NewDeviceCount = countof(NewValue, @"""Id""")
| where NewDeviceCount > OldDeviceCount

To detect high-volume SharePoint/OneDrive access via python-httpx:

CloudAppEvents
| where ApplicationId == "20892" or ApplicationId == "15600"
| where ActionType in ("FileDownloaded", "FileAccessed", "SyncDownloadedFull")
| where isnotempty(AccountObjectId)
| where isnotempty(IPAddress)
| where isnotempty(UserAgent)
| where UserAgent has 'python-httpx'
| summarize FilesAccessedLastWindow = count() by AccountObjectId, IPAddress, UserAgent, bin(Timestamp,2h)
| where FilesAccessedLastWindow >=100

Regular review of these queries and prompt investigation of anomalies are essential for early detection and response.

References

About Rescana

Rescana is a leader in third-party risk management (TPRM), providing organizations with a comprehensive platform to assess, monitor, and mitigate cyber risks across their digital supply chain. Our advanced analytics and threat intelligence capabilities empower security teams to proactively identify vulnerabilities, respond to emerging threats, and ensure compliance with industry standards. For more information about how Rescana can help strengthen your organization’s cyber resilience, please contact us at info@rescana.com.