Microsoft Warns of Passkey Phishing Campaign Hijacking Cloud Accounts via Fake IT Support Calls

Microsoft disclosed on September 13, 2026 a highly targeted campaign in which attackers call or message a user's personal phone number, posing as their organization's IT help desk, and urge them to immediately update their passkey, MFA, or SSO configuration to avoid access disruptions.

A Campaign Running Since May 2026

Microsoft Security Research has observed this activity since May 2026 across multiple compromised accounts — a four-month-plus window that underscores how long a well-executed social engineering campaign can operate before broad public disclosure.

Extensive Reconnaissance Before the Call

Attackers conduct extensive reconnaissance before ever making contact, gathering details such as victims' workplaces, job roles, and personal phone numbers from public sources like social media and professional networks — making the eventual impersonation call convincingly specific rather than a generic cold approach.

What Happens After Access Is Gained

• Unusual sign-ins from new locations or devices
• Attacker-added authentication methods on the compromised account
• High-volume Microsoft Graph API activity
• SharePoint and OneDrive file downloads, plus email collection through REST APIs

A Related CEO-Impersonation Email Campaign

Microsoft separately disclosed a related campaign in which threat actors sent over a million scam emails between August 3-5, 2026, posing as CEOs of target companies to convince accounts payable departments to initiate wire transfers for a supposed ServiceNow annual subscription — a reminder that social engineering campaigns increasingly run multiple parallel attack vectors rather than relying on a single technique.

What This Means for Enterprise Security Teams

A campaign specifically targeting passkey and MFA re-enrollment — mechanisms organizations adopted precisely to defeat traditional password phishing — is a concrete signal that IT help desk verification procedures, not just authentication technology itself, need renewed scrutiny: any credential or authentication-method change request arriving via an unsolicited phone call deserves independent verification through a known-good channel before being honored.