Passkey-themed social engineering leads to identity and cloud compromise

Threat actors are exploiting user trust in passkey technology by impersonating IT helpdesk staff and directing victims to phishing sites that harvest both credentials and live session tokens, effectively bypassing MFA protections. Once inside, attackers establish persistent MFA footholds and use Microsoft Graph APIs to silently conduct reconnaissance and exfiltrate data from SharePoint, OneDrive, and email. This attack chain is particularly dangerous because it targets the human element rather than technical vulnerabilities, meaning even well-patched environments remain exposed. The abuse of legitimate cloud APIs like Microsoft Graph for data collection makes detection harder, as malicious activity blends with normal usage patterns. Organizations that rely solely on MFA as a security guarantee without layered detection and user education are especially vulnerable.