According to Microsoft, the activity begins with identity-focused social engineering and impersonation infrastructure, then progresses through authentication persistence and cloud reconnaissance before culminating in targeted data access consistent with data collection and potential exfiltration. Microsoft Threat Intelligence assesses that the initial access techniques observed in this campaign are used by a range of threat actors, including Storm-3121, Storm-3032, and others.
The attack typically begins with what appears to be a routine call or message to a user's personal phone number from someone posing as the organization's IT helpdesk. Microsoft found that a "passkey" narrative is frequently used as a pretext, guiding victims through adversary-in-the-middle phishing or device-code authentication flows designed to hijack their session.
Once initial access is achieved, the actor's first priority is converting a temporary compromise into a persistent foothold. This is typically done by enrolling a new multi-factor authentication (MFA) method under the attacker's control, such as registering a new phone number, an authenticator app, or a software-based one-time password token.
With MFA persistence established, the actor moves into an extensive internal reconnaissance phase, using Microsoft Graph to inventory users, groups, permissions, resources, and accessible content across the compromised tenant.
Following reconnaissance, the actor transitions into large-scale data collection across Microsoft 365 workloads. Microsoft observed significant volumes of FileAccessed and FileDownloaded events across SharePoint and OneDrive, indicating systematic retrieval of cloud-hosted documents and organizational data.
Microsoft recommends that defenders investigate this attack sequence across identity, Microsoft Graph, SharePoint, OneDrive, and Exchange signals. For confirmed compromises, organizations should revoke active sessions and remove any unauthorized authentication methods added by the attacker.
Microsoft further advises enforcing phishing-resistant MFA through Conditional Access policies, along with Conditional Access rules requiring a managed, compliant device for access to Exchange, SharePoint, and Graph-privileged applications.
Microsoft has published a list of indicators of compromise associated with the campaign. These include domains tied to fraudulent passkey support and setup lures, such as passkeyhelpdesk[.]com, secure-passkey[.]com, setupmypasskey[.]com, and add-passkey[.]com. Additional domains are linked to identity-provider sessions and key synchronization infrastructure, including oktasession[.]com, keysyncos[.]com, oskeysync[.]com, oskeysetup[.]com, oskeyregister[.]com, syncmykey[.]com, myconnectkey[.]com, and oskeyconnect[.]com. Other identified domains, validationsetupac[.]com and portalsetuphub[.]com, are associated with account validation and portal setup lures respectively.
Microsoft's report underscores the growing sophistication of identity-based attacks that blend social engineering with legitimate cloud APIs, making early detection across authentication and Graph activity critical for organizations defending Microsoft 365 environments.
