Fake Passkeys and CEO Impersonation: Microsoft Exposes Two Nasty Cloud Attack Campaigns
Microsoft has published details of two separate attack campaigns that, between them, cover most of the classic hits: financial fraud emails, fake help desk calls, adversary-in-the-middle phishing, and post-compromise data theft at scale. Neither is particularly novel in isolation. Together, they paint a fairly grim picture of where business email compromise and cloud account hijacking are heading.
The first campaign ran for roughly 48 hours between August 3 and 5, 2026, and involved more than a million scam emails. The attackers spoofed CEOs and other senior executives at target companies, sending fabricated ServiceNow renewal invoices to finance and accounts payable teams. The goal was to trick someone into authorising an ACH bank transfer to an attacker-controlled account.
What made this one stand out was the layering. Rather than firing off a single dodgy invoice, the threat actors constructed entire fake email threads, complete with forged approval chains and executive signatures. Recipients saw what looked like an internal conversation that had already been reviewed and signed off. Microsoft believes generative AI was used to produce personalised email content at scale, which would explain how they managed to tailor messages across sectors including IT services, real estate, consumer goods, and manufacturing without obviously falling apart under scrutiny.
Registered infrastructure included domains like service-nowinc[.]com and domainlify[.]net, used to host the spoofed content and lend the operation a thin coat of legitimacy.
The second campaign is more technically interesting and considerably more dangerous. Active since at least May 2026, it centres on social engineering attacks designed to hijack Microsoft cloud accounts by convincing employees to hand over access under the guise of a passkey or MFA update.
The setup is straightforward but effective. Attackers call or message employees on their personal phones, posing as internal IT helpdesk staff. The story is urgent: update your passkey or SSO configuration now, or lose access. Victims are directed via SMS to convincing fake Microsoft sign-in pages, where they either submit credentials or get walked through a device code authentication flow that hands account access directly to the attacker without any credential theft needed.
That last part is worth dwelling on. Device code phishing bypasses MFA entirely. There are no stolen passwords or session cookies involved. The victim effectively authorises the attacker themselves, believing they are completing a legitimate IT process.
Microsoft notes the actors put significant effort into reconnaissance before making contact, pulling employee details and organisational structures from professional networking platforms. In some cases, they used already-compromised accounts to send the same passkey-themed lures over Microsoft Teams, extending their reach internally.
The domains registered for this campaign followed a pattern designed to look like legitimate corporate IT infrastructure, with the victim organisation's name embedded as a subdomain. Examples include passkeyhelpdesk[.]com, secure-passkey[.]com, setupmypasskey[.]com, and oktasession[.]com.
Microsoft has linked parts of this activity to threat actors it tracks as Storm-3121 and Storm-3032. Storm-3032 maps to UNC6671, a group the broader security community also knows as Cordial Spider, O-UNC-045, and PREY-0058. This cluster is connected to multiple extortion brands and shares infrastructure and tactics with affiliates that splintered off from the BlackFile group, now operating under the Helix extortion label. Storm-3121, meanwhile, conducts initial access work that feeds ShinyHunters and Falcon ransomware operations.
Once inside, the attackers move quickly to make the access persistent. The priority is enrolling an attacker-controlled MFA method, typically a new phone number, authenticator app, or software OTP token. That second factor means they can continue logging in even if the victim's password is later changed, as long as the enrolled method is not removed.
From there, the post-compromise activity is methodical. Microsoft Graph API calls are used to map out the tenant, enumerate users, groups, permissions, and accessible resources. Mailboxes are inspected. SharePoint Online and OneDrive get hit with bulk download activity. Exfiltration can run for hours or days depending on how much data is accessible.
Perhaps the most pointed observation in Microsoft's writeup concerns detection. Individual Graph API calls do not look suspicious. It is only when you track the behavioural sequence across multiple events that the pattern becomes obvious. Single-call alerting will miss this almost every time. Organisations that are not correlating Graph activity holistically are, bluntly, flying blind.
The infrastructure rotation tactic compounds the problem. Attackers deliberately use different IP addresses for authentication, reconnaissance, and exfiltration, making network-based detection significantly harder.