Cybersecurity giant **Microsoft** has issued a stark warning regarding a new wave of sophisticated social engineering attacks designed to compromise corporate **Microsoft 365** accounts. These highly targeted campaigns, attributed to multiple threat actors including those tracked as **Storm-3121** (linked to **ShinyHunters** and **Falcon** extortion) and **Storm-3032** (believed to be tied to **BlackFile** members now operating under the **Helix** name), aim to steal data from cloud services. ### The Anatomy of the Attack The attacks, which have been active since May 2026, begin with extensive reconnaissance. Threat actors meticulously research target organizations and their employees, often gathering information from public sources like social media and professional networking platforms. This pre-attack intelligence enables them to craft highly convincing lures. The core of the attack involves impersonating corporate IT help desks via phone calls or messages. Victims are told they must urgently update a passkey, multi-factor authentication (MFA), or single sign-on (SSO) configuration to prevent loss of access to critical corporate systems. Employees are then directed to meticulously crafted phishing sites that mimic legitimate **Microsoft** login pages. Links to these sites are sometimes delivered via SMS to personal mobile phones, adding another layer of deception. Despite the frequent use of "passkey" in the lures, **Microsoft** clarifies that attackers are not attempting to enroll a passkey. Instead, these themes are used to trick employees into interacting with either adversary-in-the-middle (AiTM) phishing sites or device-code authentication flows. AiTM attacks allow threat actors to capture credentials and session tokens in real-time. Device-code phishing, on the other hand, manipulates victims into authorizing an attacker-controlled client through **Microsoft's** legitimate authentication pages, granting access to their account without further MFA challenges. ### Sophisticated Phishing Infrastructure Attackers register phishing domains that cleverly combine company names with keywords related to passkeys, SSO, key synchronization, account setup, and identity verification. Examples observed by **Microsoft** include `passkeyhelpdesk[.]com`, `secure-passkey[.]com`, `setupmypasskey[.]com`, `add-passkey[.]com`, `integratedsso[.]com`, `oktasession[.]com`, `keysyncos[.]com`, and `oskeysync[.]com`. To enhance believability, the victim company's name is often placed in a subdomain, such as `company-name.secure-passkey[.]com`. This activity overlaps with attacks previously documented by **Google Threat Intelligence** under the **UNC6671** threat cluster, which also utilizes phone-based social engineering and passkey-themed phishing to compromise corporate identities and access enterprise cloud environments. ### Post-Compromise: Mapping the Microsoft Cloud **Microsoft's** research provides critical insights into the attackers' post-compromise activities within **Microsoft** cloud environments. In one incident, a suspicious sign-in from an unmanaged device to a **Microsoft 365** service, identified in **Entra** logs as "OfficeHome," was observed. After completing MFA, the attacker established a valid session and immediately began enumerating accessible resources. Within minutes, the compromised session was used to access My Apps, My Profile, **Microsoft Approval Management**, account-management interfaces, and My Sign-Ins. Subsequently, the attacker accessed **SharePoint Online**, **Outlook Web**, **Microsoft 365** collaboration and search services, an internal business application, and authentication flows for virtual desktops. This session remained active for approximately an hour, during which sensitive files and internal applications were listed. In another scenario involving device-code phishing, the victim was convinced to enter a provided code into **Microsoft's** legitimate authentication page. This action issued an authentication token to an attacker-controlled **OAuth** application, granting the threat actor access to all of the user's resources and connected SSO applications—extending beyond **Microsoft 365** to services like **Salesforce**, **Google Workspace**, **Dropbox**, **Adobe**, **SAP**, **Slack**, and **Zendesk**. ### Establishing Persistence and Data Exfiltration Attackers often establish persistence by adding their own MFA methods, such as new phone numbers, authenticator applications, or software-based one-time password tokens, to compromised identities. This allows them to satisfy future MFA challenges without the victim's interaction, although **Microsoft** notes that this persistence is broken by a complete credential and session reset. Following initial access and persistence, attackers leverage **Microsoft Graph** to extensively enumerate the victim's cloud environment. They make requests to identify: * Organizations, licenses, and enabled services * Users, groups, and group membership * Directory roles and privileged accounts * Registered authentication methods * Applications and service principals * OAuth permissions and application role assignments * **SharePoint** sites, document libraries, folders, and files * **OneDrive** resources * Mail folders, messages, and attachments While requests like `/users`, `/groups`, or `/sites` are common in enterprise environments, suspicious activity is indicated when the same account, application, or access token rapidly moves across different resources, checks privileges and authentication settings, and then begins accessing email, attachments, files, or documents. The final stage involves data collection from **Microsoft 365**. **Microsoft** observed high-volume access and download activity targeting **Microsoft SharePoint Online** and **Microsoft OneDrive for Business**, with some intrusions extending into **Microsoft Exchange Online** via **REST API**-based access to email content. This activity generates significant volumes of `FileAccessed` and `FileDownloaded` events, indicating systematic retrieval of cloud-hosted documents and organizational data. Attackers appear to use automated systems, with connections observed using the `python-httpx` user agent during **SharePoint** and **OneDrive** exfiltration. To avoid detection, they deliberately avoid rapid "smash-and-grab" exfiltration, instead spreading data theft over several hours to multiple days, accessing fewer than 1,000 files or emails per hour to blend with legitimate traffic. ### Recommendations for Defense **Microsoft** recommends that organizations look for unusual sign-ins followed by new MFA registrations, extensive **Microsoft Graph** reconnaissance, and suspicious access to **SharePoint**, **OneDrive**, or **Exchange**. In the event of a compromise, administrators should immediately: * Revoke active sessions and tokens. * Reset compromised credentials. * Remove any authentication methods or mailbox rules added by attackers. * Require the user to re-register their authentication methods. Furthermore, **Microsoft** strongly advises implementing phishing-resistant MFA, limiting sensitive cloud resources to managed devices, and disabling device-code authentication when it is not strictly necessary.