Microsoft warns of passkey-themed identity phishing campaign

Microsoft Threat Intelligence described on 9 September 2026 a global social-engineering campaign that impersonated passkey enrollment and single sign-on. The company said multiple threat actors used email and voice communications to direct employees toward identity compromise and access to Microsoft 365 cloud services.

Microsoft advised organisations to correlate unusual sign-ins with new authentication-method registrations, Microsoft Graph reconnaissance and high-volume file downloads. Its assessment attributes activity to several threat clusters; it does not say that every campaign step occurred in every incident.