Passkeys have been presented as one of the most effective ways to reduce dependence on passwords, and in many cases they really are. They remove the need to type reusable secrets, resist traditional phishing far better, and shift authentication to cryptographic keys tied to the device. But whenever a security mechanism becomes familiar to users, attackers begin exploiting its name, interface, and context. Microsoft Security Research has documented a campaign observed since at least May 2026 in which passkey-themed social engineering is used in operations that lead to cloud identity compromise, the addition of attacker-controlled authentication methods, and data collection from Microsoft Graph, SharePoint, OneDrive, and Exchange.
The most important point is that this is not a flaw in passkeys themselves. Attackers are not “breaking” the cryptography that makes them secure; they are building paths that persuade users to perform apparently legitimate actions or exploiting sessions and authentication flows that have already been compromised. It is a useful reminder that modern security cannot be reduced to the question of which authentication factor is strongest. Even the best factor loses value if an attacker can obtain a valid session, add their own MFA method, or operate through an already compromised account.
The attack chain starts with identity
Microsoft describes a fairly consistent sequence: impersonation and social engineering activity, anomalous sign-ins, the addition of new authentication methods, reconnaissance through Microsoft Graph, and finally the search for and download of content from enterprise cloud services. In some cases, the activity is consistent with large-scale exfiltration and possible extortion.
This structure shows how the value of a corporate account has changed. In the past, the main target was the computer: getting malware onto a machine made it possible to search for files, credentials, and internal access. In an organization that uses Microsoft 365, Google Workspace, or similar SaaS platforms, a single cloud identity can instead directly open email, documents, directories, calendars, repositories, and connected applications. The account becomes the user’s distributed computer.
Persistence no longer necessarily requires malware
One of the most interesting aspects of Microsoft’s analysis concerns the addition of authentication methods. If the attacker can register a factor under their control, they no longer have to depend on the password stolen at the beginning. They can turn temporary access into a form of persistence that, at first glance, looks like a normal account configuration.
This technique is especially insidious because many incident-response procedures still focus on changing the password. Changing the password is necessary, but it is not enough if the attacker has already created a persistent session, registered a token, or added a new MFA method. Microsoft therefore recommends revoking sessions and removing unauthorized authentication methods, in addition to investigating the sequence of activity across the different cloud services.
Microsoft Graph has become an accelerator for attackers too
Graph is the API that allows applications to interact with a huge part of the Microsoft 365 ecosystem. For developers it is powerful because it offers a unified interface; for an attacker with valid credentials or tokens, it can become the same kind of leverage. Microsoft’s analysis reports high-volume activity consistent with automated reconnaissance and collection.
This is an important step in the transformation of cybercrime. There is no longer any need to open hundreds of folders manually: the same APIs built to automate legitimate work can also automate the search for valuable content. Once an identity is compromised, the attacker can move at software speed.
Why phishing still works after passkeys
Passkeys reduce one class of attack, but they do not eliminate social engineering. A user can still be persuaded to install an application, approve OAuth consent, follow a “recovery” procedure, disclose a code, or change settings. The attack surface shifts from a static secret to the relationship among user, device, application, and session.
This means companies must abandon the idea of a single miracle technology. Phishing-resistant authentication is a pillar, but it must be combined with conditional access, device controls, limits on registering new methods, monitoring of anomalous sign-ins, and the ability to correlate signals between identity and data.
The real warning is how normal the infrastructure looks
Microsoft stresses that domains, IP addresses, and providers can change quickly. It therefore urges defenders not to rely only on static indicators, but to look for the behavioral sequence: identity compromise, persistence, reconnaissance, content discovery, and exfiltration.
This recommendation reflects a broader problem. Attackers increasingly use legitimate cloud services, commercial hosting, and tools available to everyone. Blocking one address or one signature solves little if the attack can be recreated a few hours later on new infrastructure. Understanding behavior becomes more important than classifying traffic as “good” or “bad” based only on where it comes from.
Incident response must treat identity as a system
When an account is compromised, the first question should not simply be “did we change the password?”, but “what changed in the identity?”. Teams need to check MFA methods, registered devices, authorized applications, tokens, sessions, mail-forwarding rules, Graph activity, and anomalous downloads.
This requires closer collaboration among teams that may previously have worked separately: identity, endpoint, email, cloud security, and data protection. If each team looks only at its own logs, the chain may appear as a series of disconnected events. Correlation is what reveals the incident.
Passkeys are still a good idea, but they are not the end of the problem
It would be a mistake to read this campaign as proof that passkeys “do not work.” On the contrary, eliminating reusable passwords and reducing the chance of handing them to a fake site remains a major improvement. The problem is expecting a single innovation to make every other layer of security irrelevant.
The history of cybersecurity is a sequence of shifts. When one layer becomes harder to attack, the adversary looks for another path. Today, value is concentrating around cloud identity and the sessions that allow legitimate services to be used as if the attacker were the user. Microsoft’s work shows that the next generation of defenses will need to be just as capable of reading relationships, context, and behavior.
The lesson is less reassuring than a slogan but more useful: strong authentication reduces risk, it does not eliminate it. In the cloud era, the perimeter is no longer the corporate network; it is the dynamic set of identities, permissions, and data that follow a person wherever they work.
