Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data

Microsoft described two campaigns. In the first, more than one million scam messages impersonating chief executive officers were sent to persuade finance personnel to initiate ACH payments for a fake ServiceNow invoice. In the second, passkey-, multifactor-authentication-, and single-sign-on-themed social engineering was used to take over Microsoft cloud accounts, add attacker-controlled authentication methods, and collect and exfiltrate data from SharePoint, OneDrive, mailboxes, and other cloud resources.