Microsoft disclosed two active campaigns in which attackers abuse third-party email infrastructure to run financial fraud scams and use passkey-themed social engineering to break into cloud accounts.

 

What happened

Microsoft identified two separate campaigns. In the first, attackers sent more than a million scam emails between August 3 and 5, 2026, impersonating company CEOs to convince accounts payable staff to make ACH transfers for a fake ServiceNow subscription. The attackers used generative AI to draft the email templates and used fabricated invoices and forged email threads to make the requests look legitimate. The campaign targeted enterprise users in the US across IT services, consumer goods, real estate, and manufacturing.

In the second campaign, active since May 2026, attackers called or messaged employees' personal phones, posing as IT help desk staff, and urged them to update their passkey, MFA, or SSO settings. Victims were directed to fake Microsoft sign-in pages that captured credentials or triggered adversary-in-the-middle or device-code authentication flows, letting attackers take over accounts and register their own MFA methods.

 

Going deeper

Once attackers gained account access, they focused on turning a temporary compromise into a lasting foothold. Rather than relying only on stolen credentials, they registered their own MFA method, such as a new phone number, authenticator app, or OTP token, allowing them to sign in without the victim's involvement even if the original credentials were reset.

 

What was said

The Microsoft Security Research team described how the invoice scam campaign built credibility, "Unlike traditional invoice scams that rely on a single social engineering lure, this campaign layered executive impersonation, vendor branding, fabricated invoices, and supporting email conversations into a unified narrative intended to reduce recipient skepticism."

On the cloud intrusion campaign, Microsoft said the threat actor does significant groundwork before attacking, "The actor appears to invest heavily in pre-attack research, likely gathering information about employees and organizational structure from public sources such as social networking and professional profiling platforms."

 

In the know

Passkeys are a login method meant to replace passwords with device-based cryptographic credentials, and multi-factor authentication (MFA) adds a second verification step, such as a code or authenticator app, besides a password.

Device-code phishing and adversary-in-the-middle (AitM) attacks are techniques that trick a legitimate login flow into handing attackers a valid session or approval, letting them bypass MFA without stealing a password directly. Microsoft Graph is the API that lets applications and, in this case, attackers, read and interact with a tenant's mail, files, and directory data.

 

Why it matters

This campaign targets features organizations rolled out to stop phishing. Passkeys and MFA are usually presented as the fix for credential theft, but here attackers use the rollout of passkeys itself as the social engineering hook, calling employees and telling them their passkey needs "setup" or "updating." Combined with device-code and AitM flows that don't require stealing a password at all, this shows that adding MFA or passkeys doesn't remove the need for employees to verify help desk-style requests through a separate, trusted channel.

 

The bottom line

Attackers are targeting the security upgrades meant to stop them, using passkey and MFA rollouts as a pretext for voice phishing while automating executive impersonation fraud with AI. Organizations should verify IT help desk contact through a separate, known channel before changing authentication methods, and train accounts payable staff to independently confirm payment requests rather than trusting invoice details or email threads alone.

 

FAQs

What is a passkey?

A passkey is a login credential stored on a device that replaces a traditional password with cryptographic authentication.

 

Are passkeys less secure than passwords?

Passkeys are considered more phishing-resistant than passwords, but they can still be undermined if an attacker tricks a user into approving a fraudulent login through social engineering.

 

Does multi-factor authentication (MFA) fully prevent account takeover?

No, MFA reduces risk but doesn't guarantee protection, since attackers can bypass it through techniques like device-code phishing or by registering their own MFA method after gaining initial access.

Read also: HIPAA Compliant Email: The Definitive Guide (2026 Update)