Microsoft Cloud Accounts Hijacked via AI-Powered Passkey Phishing
Threat actors use generative AI and social engineering to bypass MFA and exfiltrate data.
1Two-Pronged Cloud Attack Campaign
Microsoft revealed two ongoing campaigns targeting cloud environments. The first involves mass CEO-impersonation emails to trigger fraudulent ACH transfers, while the second uses passkey-themed social engineering to hijack Microsoft accounts. Both leverage third-party email infrastructure and sophisticated impersonation tactics, primarily affecting U.S. enterprises in IT services, consumer goods, and manufacturing sectors since August 2026.
2AI-Generated Phishing Templates
Attackers used generative AI to create highly personalized email templates and draft messages tailored to recipients. This automation allowed them to send over 1 million scam emails in just 3 days (August 3-5, 2026). The emails contained fabricated invoices, forged approval threads, and executive signatures to bypass scrutiny from accounts payable departments regarding ServiceNow subscription payments.
3Multi-Layered Social Engineering
Unlike traditional invoice scams, this campaign combined executive impersonation, vendor branding, fake invoices, and supporting email threads into a cohesive narrative. Attackers registered spoofed domains mimicking trusted brands and inserted victim organization names as subdomains (e.g., 'companyname.maliciousdomain.com'). They specifically targeted CEOs, CFOs, and presidents to add credibility to payment requests.
4Passkey-Themed Cloud Intrusions
The second campaign since May 2026 uses phone-based social engineering, where attackers pose as IT helpdesk staff urging victims to update passkeys or MFA settings. Victims are redirected to fake Microsoft login pages via SMS to their personal devices. Successful breaches lead to high-volume data exfiltration through Microsoft Graph API, SharePoint, and OneDrive downloads.
5Adversary-in-the-Middle Tactics
Attackers implement AitM (adversary-in-the-middle) flows during authentication, capturing credentials or gaining access permissions. They register domains themed around SSO enrollment and identity verification. Microsoft attributes these activities to Storm-3121 (linked to ShinyHunters extortion) and Storm-3032 (UNC6671), a splinter group from BlackFile operating under the Helix extortion brand.
6Pre-Attack Reconnaissance
Threat actors conduct extensive research using public sources like professional networks to gather employee and organizational data. In some cases, they leverage already compromised accounts to spread passkey-themed phishing via Microsoft Teams. The operation shares infrastructure with cybercrime groups Cordial Spider and O-UNC-045, suggesting possible collaboration or tool sharing.
7Automated Data Harvesting
Post-compromise, attackers use proxy-associated infrastructure for automated data collection. One observed case involved anomalous sign-ins from unmanaged devices to access SharePoint Online and OneDrive via Graph API. The actors then enumerate sensitive files and internal services, indicating objectives beyond immediate financial gain.
8Evolving Extortion Ecosystem
This campaign highlights how cybercriminals are professionalizing operations through AI automation and shared playbooks. The overlap between Storm groups and historical actors like BlackFile shows how threat actors fragment and rebrand while maintaining tactical continuity. Organizations must enhance MFA resilience and train staff against voice phishing and multi-channel social engineering.