It starts with a phone call to a personal mobile number. The caller says they are from the IT helpdesk, that something is wrong with the passkey or the multifactor setup, and that it has to be fixed immediately or the account will stop working. A link arrives by text. It leads to a page that looks like the Microsoft sign in screen.
Microsoft Security Research says that call is the first step in a run of cloud intrusions it has tracked since May 2026, and it has now published the rest of the sequence. Its advice is to hunt the sequence, not the domains, because the infrastructure changes far faster than the tradecraft.
The passkey is a story, not the goal
The most useful finding is that the attackers usually do not care about passkeys. The narrative is a pretext, a reason for an employee to authenticate on command, and it leads to one of two things. The first is adversary in the middle phishing, where the fake login page sits between the victim and the real Microsoft service, relaying the login and keeping the credentials and session cookie that come back. The second is device code phishing, where the victim is talked into typing a short code into a genuine Microsoft page, issuing a token to an application the attacker controls, so nothing is stolen from the browser at all. Either way the victim satisfies the multifactor prompt in real time, and the attacker reuses it.
If the employee opened the link on a personal phone with no endpoint monitoring, there is often no technical evidence of that first step, and their memory of the call becomes the earliest record of the breach.
A lookalike domain with your name on it
A favourite trick is to register a generic domain and put the target's name in front as a subdomain, producing addresses like contoso[.]add-passkey[.]com that read correctly at a glance. Microsoft lists secure-passkey[.]com, integratedsso[.]com and oktasession[.]com among them, several registered through Nicenic and live within hours. Sometimes the request arrives over Microsoft Teams instead, from an account the attackers already own, a move IntelFusions saw in August when callers posing as helpdesk staff went after domain controllers.
They register their own second factor
Once inside, the attacker's first move is not to steal data. It is to add an authentication method of their own: a new phone number, an authenticator app, or a software token that appears in the audit log as NO_DEVICE. From then on the account's multifactor challenge can be answered without the employee.
Sixteen minutes to the mailbox
The published timeline is worth reading slowly. Authentication completes a minute in. By minute two the session is listing the applications assigned to the identity, and by minute four it is querying sign in and security settings through the Microsoft Graph API, the interface that fronts almost everything in Microsoft 365. Between minutes eleven and fifty it requests SharePoint sites, documents and mailbox services, and at minute fifteen it calls the Outlook attachment download endpoint. The records show a resource requested, not proof a file was opened. Sessions ran about an hour, and much was automated by a purpose built tool driving Graph, one reason token theft against Microsoft 365 keeps getting easier.
Kill the sessions, then the extra factor
Microsoft's guidance for a confirmed compromise is to revoke sessions and remove unauthorized authentication methods, in that order: a password reset that leaves the attacker's authenticator app registered achieves very little. The report ships a hunting query that diffs the old and new values of a user's authentication methods and returns accounts where a device was added, the cheapest detection in the chain. Phishing resistant multifactor genuinely helps against the first path. What none of this required was a vulnerability.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.