Attackers Pose as Help Desk, Abuse Fake Passkeys to Steal Microsoft 365 Tokens

Key points

• Attackers impersonate IT help desk staff to build trust with Microsoft 365 users.
• Victims are prompted with fake passkeys that help capture authentication tokens.
• Stolen tokens can be replayed for cloud data access without needing a password.
• No CVE is tied to this activity; it relies on deception rather than software flaws.
• Scale and timing remain unspecified, so exposure varies by organization.

A social-engineering operation is using a familiar trust lever: the internal service desk. According to available reporting, intruders contact Microsoft 365 users while posing as IT support, then steer them toward counterfeit passkey prompts. The goal is not to crack a password but to obtain authentication tokens that can be used elsewhere.

The targets are organizations running Microsoft's cloud productivity suite, especially employees who expect help-desk outreach and may not question a request to register a new sign-in method. Once a token is captured, the attacker can attempt to reach cloud data, mailboxes, files, and other connected services while appearing to be a legitimate session.

This matters because token-based access can bypass some traditional password defenses and may not trigger the same alerts as a stolen credential. The activity does not depend on a software vulnerability; there is no CVE assigned. Instead, it exploits human workflows and the growing use of passkeys as a security control.

The scale is currently unspecified, and no dates were provided, so it is unclear how many tenants or users have been approached. Even so, the playbook is consistent with a broader trend: attackers increasingly target identity systems rather than endpoints.

Administrators should watch for unexpected passkey registrations, help-desk impersonation reports, impossible-travel or anomalous token use, and new mail-forwarding or file-sharing rules. User education should stress that real IT teams will not ask for passkey enrollment through unsolicited links or calls. Verification through a known internal channel is essential.

What to do now

1. Enable phishing-resistant MFA and require number matching or certificate-based authentication for Microsoft 365 administrative and high-risk accounts.
2. Audit and restrict passkey registration so only approved users can add new authentication methods; alert on any new passkey or security-key enrollment.
3. Monitor identity logs for token replay, anomalous sign-ins, and impossible-travel events; revoke refresh tokens and sessions for suspected compromises.
4. Train staff to verify unsolicited IT support requests through a known internal phone number or ticketing system before acting.
5. Block or quarantine external messages that mimic internal help-desk branding, and add warning banners to external email.
6. Review conditional access policies to limit cloud data access from unmanaged devices and unfamiliar locations.
7. Establish an incident response playbook for token theft that includes password reset, session revocation, and mailbox rule review.

Original source

Hackread