Passkey Phishing Campaign Targets Microsoft Cloud Accounts, Microsoft Warns

Microsoft has disclosed details of two campaigns in which threat actors are abusing third-party email delivery infrastructure to send financial fraud scam messages and using passkey-themed social engineering to breach cloud environments.

The first campaign involved sending over a million scam emails between August 3 and 5, 2026, by masquerading as chief executive officers. These emails likely aimed to trick recipients into performing financial actions, such as wire transfers or payment changes, exploiting the authority of executive roles.

The second campaign uses passkey-themed social engineering to hijack Microsoft cloud accounts and exfiltrate data. While passkeys are generally considered more secure than passwords, attackers are leveraging user unfamiliarity with the technology to trick victims into approving authentication prompts or revealing credentials. The exact method of the social engineering is not detailed, but it likely involves fake notifications or phishing pages that mimic passkey authentication flows.

Microsoft has not attributed the campaigns to specific threat actors, and no technical exploit details have been provided. The disclosure, published by The Hacker News on September 13, 2026, highlights the evolving tactics of attackers who are adapting to new authentication technologies.

Organizations using Microsoft cloud services should be vigilant for unusual sign-in attempts and educate users about passkey-related phishing. Enabling phishing-resistant MFA, such as FIDO2 security keys, and monitoring for anomalous authentication patterns are recommended defensive measures.