Microsoft details passkey-themed cloud-account phishing campaigns

Microsoft disclosed two campaigns that used third-party email delivery infrastructure and passkey-themed social engineering against enterprise accounts. In the cloud intrusions, attackers contacted employees by phone or message, directed them to counterfeit sign-in sites, then used adversary-in-the-middle or device-code authentication flows. Microsoft said compromised accounts were used for Microsoft Graph activity, mailbox collection, and SharePoint and OneDrive downloads; attackers also added authentication methods in some cases to retain access. The activity has been detected since May 2026 and affected multiple accounts.