← 피드로
Email
1. Basic Information
- Original Source: Passkey-themed social engineering leads to identity and cloud compromise
- Publisher: Microsoft Security Research
- Published Date: 2026-09-09
- Updated Date: Not specified
- Severity: critical
- Severity Reason: Active campaigns were observed using unmanaged personal devices as the initial contact point, chaining post-authentication sessions, MFA registration, Microsoft Graph, SharePoint, OneDrive, and Exchange.
- Related Information Source: Dark Reading summary
2. Summary
Attackers pose as IT staff via phone calls and SMS under the pretext of updating passkeys or multi-factor authentication (MFA) to gain access to Microsoft 365. Cases have been reported involving AiTM relaying authentication on fake sites and device code phishing where victims approve the attacker’s client on legitimate authentication screens. This does not involve breaking the cryptography of passkeys themselves.
3. Attack Flow
Microsoft 365 Session Compromise and MFA Persistence via Passkey-Themed Voice Calls and SMS
- Callers or SMS messages posing as IT staff are sent to personal phone numbers, urging updates to passkeys, MFA, or SSO. Microsoft points out that attackers may have pre-researched employees and organizations using public information.
- AiTM uses fake authentication sites to obtain credentials and session tokens. In another device code flow, victims enter codes on legitimate Microsoft screens, causing tokens to be issued to attacker-managed clients. Browser cookie theft is not a mandatory path.
- The acquired session is used to enumerate My Apps, My Sign-Ins, and business applications.
- Attacker-managed phone numbers or authentication apps are added as MFA methods. If valid credentials or sessions remain, they serve as a foothold for re-authentication.
- Documents and emails are searched and collected from Microsoft Graph, SharePoint, OneDrive, and Exchange.
- Microsoft has observed heavy data access and downloads, and is investigating the possibility of collection and exfiltration. The exact volume of theft and the success of final extortion in individual cases remain unconfirmed.
4. Attacker Location and Execution Point
- A remote attacker who contacts the victim’s personal phone number and sets up a fake Microsoft authentication infrastructure or a device code flow.
5. Visibility for Victims and Administrators
Victims
- Receive calls or SMS messages claiming to be the IT help desk, along with instructions to urgently update passkeys or SSO. Because legitimate Microsoft authentication screens appear in device code flows, the legitimacy of the request cannot be judged by screen validity alone.
Administrators
- Unusual sign-ins, additions of MFA methods, and continuous access to Graph, SharePoint, OneDrive, and Exchange may occur. Initial app discovery should be viewed separately from subsequent data collection spanning hours to days.
6. Success and Failure Conditions
Success Conditions
- The user believes the instructions in the call or SMS and proceeds with authentication operations.
- In AiTM types, non-phishing-resistant authentication is relayed. In device code types, tokens are passed to the attacker’s client through approval on legitimate screens, which is treated as a separate success condition.
- Conditional Access permits the relevant flow or access, and the compromised identity holds permissions to apps and data.
- Adding an MFA method requires registration operations to be permitted under the compromised authentication state.
Failure Conditions and Risk Mitigation
- Enforce phishing-resistant MFA (such as FIDO2 or passkeys) and establish identity verification procedures that do not instruct users to update credentials solely via phone or SMS.
- Block device code flows unnecessary for business operations using Conditional Access. Limit necessary exceptions to specific users and use cases, and address paths that abuse approval on legitimate screens.
- Establish conditions such as fresh, strong authentication or managed devices for registering authentication methods, and monitor unauthorized additions.
- Restrict access or downloads to Microsoft 365 from unmanaged devices based on business requirements.
7. What Happens Upon Success
- Compromise of Microsoft 365 sessions and cloud identities
- Persistence via attacker-managed MFA methods
- Collection and potential exfiltration or extortion of emails, documents, and organizational information
8. Observable Logs
Inference: Logs and collection conditions useful for investigation are organized based on published attack behaviors.
- Operations related to searching and retrieving emails and attachments found in Exchange mailbox audits and cloud operation logs. Standard mail delivery logs alone cannot track collection.
Proxy / SWG / DNS
- Records of connections to fake authentication domains from monitored devices and communication paths. On unmanaged personal devices and cellular networks, records may not remain in corporate DNS or SWG.
Endpoint / EDR
- Browser operations when links are opened on managed devices. In cases starting on unmanaged personal devices, reports of calls/SMS or preserved messages serve as initial contact clues.
Identity / IdP
- Sign-in logs showing users, apps, authentication methods, sources, session and Conditional Access results, and audit records of authentication method registrations and modifications. Error 50074 indicates a request for additional authentication and does not mean an attack by itself.
SaaS / Cloud
- Microsoft Graph activity logs, where logging is enabled, SharePoint and OneDrive events such as FileAccessed and FileDownloaded, and records related to Exchange email retrieval. Distinguish between successful sign-in and actual data retrieval events.
Network
- Access source IPs and user agents remaining in cloud-side audit records. Because IPs change during attack stages, correlation limited only to the same IP may lead to oversights.
9. Attack Success Determination
- User Action Confirmed: Sessions after victims complete MFA or device code authentication are confirmed in the cases.
- Malware Execution or Successful Authentication Confirmed: Successful authentication to OfficeHome or internal apps, and the addition of attacker-managed MFA methods have been reported. What is confirmed here is authentication and identity compromise, not malware execution on the device.
- Information Theft or Session Compromise Confirmed: Microsoft observed activities related to SharePoint and OneDrive FileAccessed/FileDownloaded and Exchange email collection, in addition to session and token compromise. However, individual sign-in examples alone do not prove the acquisition of documents or attachments or the launch of virtual desktops, and the volume of theft per case remains unconfirmed.
10. Investigation Playbook
Inference: The following are investigation procedures if a similar attack is suspected in your organization.
Starting Point
- Start from reports of calls or SMS claiming to be IT staff, unusual sign-ins, unfamiliar MFA method additions, and cloud data retrieval anomalies.
Initial Verification
- Confirm contact times, phone numbers, received URLs, whether codes were entered, and devices used for operations. Preserve messages and screens without reopening URLs.
Endpoint
- Confirm whether the operating device was under corporate monitoring. If unmanaged, do not treat the lack of EDR records as proof of non-compromise; cross-reference user reports with IdP and cloud records.
Identity / Cloud
- Trace from sign-in to MFA method additions, Graph enumeration, and file/mail retrieval by user ID, app, session, and time. Distinguish between AiTM and device code types, and examine IP changes.
Subsequent Investigation
- Do not infer data access or theft from sign-in destinations alone; identify target data using records of file retrieval and mailbox operations. Examine activity of the same ID over hours to days, along with added authentication methods and mailbox rules.
Containment
- Revoke valid sessions and refresh tokens for compromised IDs, and reset credentials. Remove unauthorized authentication methods and mailbox rules, and re-register secure authentication methods after identity verification.
Judgment
- Record evidence of user approval, successful attacker authentication, MFA addition, data retrieval, and exfiltration separately. Do not assume document retrieval or desktop startup is confirmed merely by app sign-ins.
11. Defense and Detection Ideas
Inference: The following are detection and mitigation proposals based on public information. Do not judge maliciousness based on a single match alone; cross-reference with normal business operations.
Single Event
- Extract suspicious MFA additions and unusual cloud operations. Do not treat error 50074, Graph API usage, or specific user agents as malicious by themselves.
Time Series Correlation
- Correlate whether unusual sign-ins are followed by MFA additions, multiple types of Graph enumeration, and file/mail retrieval. Focus on users and apps, and track activities where source IPs change.
Threat Hunting
- Use reports of contacts under the pretext of passkey updates as a starting point to retroactively search for authentication method changes and subsequent Microsoft 365 operations. Target not only massive short-term retrievals but also continuous retrievals spanning hours to days.
Log Gaps
- Verify collection settings and retention periods for IdP sign-in/audit logs, Graph operation logs, and file/mail audits. Set up reporting channels assuming cases where personal device operations are not visible.
Priority Measures
- Enforce phishing-resistant MFA (such as FIDO2 or passkeys) and establish identity verification procedures that do not instruct users to update credentials solely via phone or SMS.
- Block device code flows unnecessary for business operations using Conditional Access. Limit necessary exceptions to specific users and use cases, and address paths that abuse approval on legitimate screens.
- Establish conditions such as fresh, strong authentication or managed devices for registering authentication methods, and monitor unauthorized additions.
- Restrict access or downloads to Microsoft 365 from unmanaged devices based on business requirements.
12. Facts / Inference / Hypothesis
Facts
- Since May 2026, Microsoft observed multiple account compromises where abnormal sign-ins were followed by MFA additions, heavy Microsoft Graph usage, SharePoint/OneDrive downloads, and email collection via REST APIs.
- Attacks began with calls or SMS to personal phone numbers, urging urgent updates to passkeys, MFA, or SSO while posing as IT staff.
- Passkey updates were used as a pretext, targeting credentials and session tokens in AiTM types. In device code types, tokens were issued to attacker clients through victim approval on legitimate Microsoft screens.
- In one case, MFA and authentication completed within about one minute of sign-in initiation, followed by access from the same session to My Apps, My Sign-Ins, SharePoint, Outlook, and internal apps. Sign-in records alone cannot confirm application function execution or file retrieval.
- Attackers added attacker-managed phone numbers, authentication apps, or software OTPs as MFA methods to victim IDs. This persistence depends on access to valid credentials or tokens. It does not mean the attacker can retain access after unauthorized MFA methods are removed, credentials are reset, and sessions are revoked.
- If personal devices lack Defender for Endpoint management, initial link access may be absent from the organization’s endpoint telemetry, and user phone/SMS reports may be the sole evidence explaining initial entry.
Inference
- Observable logs, investigation playbooks, and defense/detection ideas are proposals based on published authentication and cloud compromise flows. Link multi-service records centering on IDs to distinguish successful authentication from data retrieval.
Hypothesis
No additional hypotheses. Unconfirmed items are listed in “Unanswered Questions and Further Research”.
13. MITRE ATT&CK Mapping
Inference: Mappings based on published behaviors.
- T1566.004 Phishing: Spearphishing Voice (Confidence: high): Guides authentication operations via calls posing as IT staff.
- T1557 Adversary-in-the-Middle (Confidence: high): Relays credentials and sessions via fake authentication sites.
- T1098.005 Account Manipulation: Device Registration (Confidence: high): Adds attacker-managed authentication methods.
- T1114 Email Collection (Confidence: high): Collects emails via Exchange/REST APIs.
14. Unanswered Questions and Further Research
- The specific roles played by Storm-3032 and Storm-3121 in each case, and final buyers or extortion actors.
- Total volume of files and emails actually exfiltrated externally in individual cases.
15. Impact on SOCs and Organizations
When attacks start from calls or SMS to personal devices, initial operations may not remain in corporate device monitoring. SOCs must connect user reports with authentication method modifications and Microsoft 365 operations. In addition to adopting passkeys, managing authentication registration procedures and unnecessary device code flows helps address paths where attackers induce legitimate authentication operations. During investigations, rather than narrowing down solely to the same IP or massive short-term downloads, it is important to track continuous enumeration and retrieval centered around IDs.
16. Summary by Target Audience
- SOC: Track abnormal sign-ins, new MFA registrations, and Graph/SharePoint/Exchange accesses in chronological order, starting from phone/SMS reports.
- Administrator: Enforce phishing-resistant MFA, authentication registration conditions, and restrictions on unmanaged devices, while blocking unnecessary device code flows.
- User: If urged to update passkeys or MFA by callers claiming to be IT staff, do not use links or codes during calls and verify through official channels.