Microsoft Cloud Compromised by Passkey Phishing

Microsoft disclosed two separate campaigns in which threat actors abused third‑party email delivery infrastructure to blast financial fraud scam messages and then leveraged passkey‑based social engineering to breach its Azure Active Directory environments between August 3–5 2026, sending over a million emails that masqueraded as chief executive officers¹.

Passkeys rely on cryptographic signatures tied directly to the device or authenticator rather than a central password database; attackers can use the same keys stored within Azure AD without triggering additional security alerts beyond what would happen after any successful traditional account takeover.

Earlier multi‑factor authentication breaches such as those targeting Google accounts back in 2019, where SMS interception was used, demonstrate that social engineering remains potent even against advanced cryptography.

Security specialists note that the core weakness lies not in the cryptographic strength of passkeys but in human factors—once users accept an urgent request from an impersonated executive, the attacker obtains the key and operates undetected because the event is indistinguishable from normal usage. The campaign’s volume suggests large organizations may have been targeted simultaneously.

Privacy advocates point out that reliance on device‑bound keys does not mitigate phishing risks; the scale indicates many employees across multiple Microsoft tenants likely received convincing messages, potentially leading to widespread account compromise and unauthorized data access. Similar patterns emerged before when MFA tokens or password resets were coerced through spear‑phishing; passkey attacks bypass the need for token delivery entirely by tricking users into authenticating via their own devices.

Exfiltration of sensitive corporate data following these compromises raises concerns about both privacy and operational security within cloud environments. Organizations relying on Azure AD must now consider additional layers such as behavioral analytics or stricter email filtering to detect anomalous mass requests.