AI-generated editorial illustration; not a documentary photograph.
Microsoft has warned of a campaign that uses fake IT help-desk calls and passkey-update messages to compromise workplace cloud accounts, according to TechRadar. The attackers seek access to company files and email by persuading employees to authenticate through attacker-controlled systems.
A Security Update as the Pretext
The reported approach turns an apparent account-maintenance task into an entry point. Callers impersonate the employee's IT help desk and say a passkey or multifactor authentication setting must be updated immediately to prevent disruption. A follow-up SMS directs the employee to a site resembling Microsoft's login page.
Microsoft describes substantial preparation before those calls, including research into employees' workplaces, roles and personal phone numbers. The company believes public social and professional profiles likely supply some of that information. In a smaller number of cases, attackers use already compromised accounts to send similar messages through Microsoft Teams.
Authentication Becomes the Target
The malicious pages use adversary-in-the-middle techniques that, according to the report, can obtain access on the attacker's behalf or capture credentials. Microsoft describes victims being steered into authenticating on attacker-controlled computers, making the requested action more consequential than simply visiting a deceptive page.
That distinction matters to the passkey framing: the account describes manipulation of the authentication process, not a demonstrated break of passkey cryptography. The attackers' pretext also varies with the organization's setup, referring either to passkeys or to multifactor authentication.
Files and Email in Scope
Microsoft says the campaign appears aimed at extracting files from SharePoint and OneDrive, along with email data from Microsoft Exchange Online. The affected resources are therefore workplace documents and communications, rather than only the login credentials used to reach them.
According to TechRadar's September 14, 2026 report, Microsoft said the activity had been ongoing since at least May that year. It did not disclose a victim count or attribute this campaign to a specific threat actor, leaving its scale and operator unidentified in the supplied account.
Source: Microsoft Cloud accounts stolen in highly complex impersonation and passkey phishing campaign
SIGNAL TITANS
Leave a Reply