Passkeys are designed to remove many of the weaknesses associated with passwords, but Microsoft has documented a campaign showing that strong authentication cannot compensate for a manipulated user or an inadequately protected enrollment process. The attackers are not breaking passkey cryptography. Instead, they are persuading employees to help register authentication methods controlled by the intruder.
A convincing identity attack
The campaign frequently begins with a call or message sent to an employee's personal phone. Someone claiming to represent the corporate helpdesk warns that a passkey, multifactor authentication or single sign-on configuration must be updated to prevent an interruption. The victim is then directed to an impersonation site resembling a legitimate Microsoft sign-in page.
Once access is obtained, the attackers establish persistence by adding authentication methods to the compromised account. Microsoft observed unusual sign-ins followed by Microsoft Graph reconnaissance, large SharePoint and OneDrive downloads, and email collection through application programming interfaces. This allows the operation to move from a single identity compromise to automated discovery and potential data exfiltration across cloud services.
Why passkeys are not the problem
It would be a mistake to interpret this activity as evidence that passkeys have failed. The underlying security issue is control of the enrollment, reset and recovery workflow. If an attacker can convince a user or helpdesk employee to authorize a new authenticator, the organization may treat the attacker's device as legitimate.
In my view, companies must protect authentication changes with the same rigor applied to privileged administrative actions. A successful login should not automatically make every subsequent identity-management event trustworthy.
Defensive priorities
- Require strong identity verification before helpdesk-assisted MFA or passkey resets.
- Notify users and security teams whenever a new authentication method is registered.
- Restrict application consent and require administrative approval for sensitive Microsoft Graph permissions.
- Monitor for unusual authentication enrollment, rapid cloud enumeration and high-volume file or mailbox access.
- Revoke active sessions and remove unauthorized authentication methods during incident response.
I believe the durable lesson is that identity security must cover the entire credential lifecycle. Passkeys can prevent password theft, but enrollment and recovery remain powerful control points that attackers will continue to target.