Hackers Pose as IT Support to Hijack Microsoft 365 Accounts With Fake Passkey Alerts

Gbhackers •Mayura Kathir • September 10, 2026

Threat actors are impersonating corporate IT helpdesk staff in an active social-engineering campaign that hijacks Microsoft 365 identities, establishes MFA persistence, and systematically collects data from SharePoint, OneDrive, and Exchange Online. Microsoft Security Research said it has observed the cloud-focused intrusions since May 2026. The activity is marked by unusual sign-ins, attacker-added authentication methods, extensive […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Social Engineering Campaign Hijacks Microsoft 365 Accounts via Passkey Alerts A social engineering campaign impersonating IT support staff is actively hijacking Microsoft 365 accounts. The attackers use passkey-themed lures to trick users into providing credentials, leading to unauthorized access and data exfiltration. Microsoft Security Research has tracked these intrusions since May 2026, observing unusual sign-ins, added authentication methods, and extensive data collection from SharePoint, OneDrive, and Exchange Online. The attack method involves adversary-in-the-middle phishing and device-code authentication flows. Victims are often contacted via phone or SMS, creating a sense of urgency to act. The campaign has affected multiple organizations, with ongoing investigations into the extent of the breaches. Defenders are advised to monitor Microsoft Graph, SharePoint, and Exchange signals for suspicious activity and revoke unauthorized authentication methods. 8 sources 71

Hackers Pose as IT Support to Hijack Microsoft 365 Accounts With Fake Passkey Alerts

The full story

Extracted Entities

Platforms (3)

Tools (1)