Microsoft says a threat cluster it tracks as Storm-3121 and Storm-3032 (also known as UNC6671), along with actors linked to the Helix extortion brand, has been running a passkey-themed social engineering campaign since May 2026 to hijack Microsoft cloud accounts. The attackers call or text targets’ personal phones, pose as internal IT help desk staff, and push victims toward a fake Microsoft sign-in page or a live device-code authentication prompt. Once a victim approves the prompt, the attacker inherits a valid session token and walks past the passkey and multi-factor protections the account was supposed to rely on.
The campaign matters because it does not attack passkeys themselves. Passkeys remain resistant to a fake login form asking for a password. What Microsoft describes instead is a social engineering path that routes around the credential, using adversary-in-the-middle relay and device-code flows built for legitimate scenarios like signing into a smart TV. For a CISO who rolled out passwordless authentication and considers phishing risk solved, that is the uncomfortable part: the technology worked as designed, and the account still got taken over.
The original insight here is in Microsoft’s own description of the attackers’ preparation. According to the company’s security blog, “the actor appears to invest heavily in pre-attack research, likely gathering information about employees and organizational structure from public sources such as social networking and professional profiling platforms.” That is a help desk impersonation problem, not an authentication problem, and it means the fix sits in identity verification procedures at the human layer: callback verification against a known number, out-of-band confirmation before any credential reset, and restricting device-code sign-in flows to the narrow set of devices that actually need them. CyberTech has covered the help desk as an unlocked door before, and this campaign, alongside a separate wave of business-hours M365 phishing targeting the same Microsoft 365 identity layer, suggests attackers have converged on the same conclusion: identity teams hardened the login box and left the process around it soft.
Source: Microsoft Security Blog
