Passkey Lures Are Hitting M365 — What NZ Tenants Should Tighten This Week

Microsoft Security Research published a detailed write-up on 9 September 2026: attackers are using passkey, MFA, and SSO themes as social-engineering bait against Microsoft 365 identities.

The pattern is simple and effective. Someone claiming to be your IT helpdesk calls or texts a staff member’s personal phone. They create urgency — update a passkey, fix MFA, or re-enrol SSO — then send a link that looks like a Microsoft sign-in page. In many cases the goal is not to enrol a real passkey at all. The lure walks the victim into adversary-in-the-middle (AiTM) phishing or a device-code approval on Microsoft’s legitimate auth page, so the attacker gets a usable session or token.

Microsoft links the initial-access activity to Storm-3121 (feeding ShinyHunters / Falcon extortion) and Storm-3032 (Helix). After the first foothold, the next moves are familiar: register an attacker-controlled MFA method, run Microsoft Graph reconnaissance across users, roles, apps, and sites, then collect SharePoint, OneDrive, and mailbox content — often slowly enough to blend with normal work.

Why NZ organisations should care

Entra ID and Microsoft 365 sit at the centre of how most New Zealand mid-market and public-sector organisations work. If identity is compromised, email, files, Teams, and line-of-business apps follow.

Under the Privacy Act 2020, if you hold personal information in a Microsoft tenant you need a credible way to detect unusual sign-ins and privileged activity, and a clear response path. A helpdesk-themed call to a personal mobile is exactly the kind of incident that leaves little endpoint telemetry if the phone is unmanaged.

One more point worth stating plainly: phishing-resistant MFA is still the right direction. Real passkeys and FIDO2 would have stopped the phishable MFA these actors are bypassing. The campaign abuses the story of passkeys, not the cryptography.

What to do this week

• Tell your people the script. Unsolicited calls or texts about “updating your passkey / MFA / SSO” are not how Zenaos — or any sensible IT team — works. Give them a verified channel to check before they click or approve anything.
• Enforce phishing-resistant MFA via Conditional Access for admins first, then high-risk users (FIDO2 / passkeys, Windows Hello for Business where licensing allows). Push and SMS are better than nothing; they are not enough for privileged roles.
• Block device-code and authentication-transfer flows in Conditional Access unless you have a named business exception. Device-code phishing is a core path in this campaign.
• Require managed, compliant devices for Exchange, SharePoint, and Graph-privileged apps where you can. Limit unmanaged access to web-only sessions without download or sync.
• Harden security-info registration. Separate Conditional Access for registering MFA methods: phishing-resistant strength, managed devices and/or named locations, and block registration at high sign-in risk. Require a fresh interactive sign-in.
• Hunt the sequence, not a single IP. Unusual sign-in → new authentication method → Graph enumeration → bulk SharePoint / OneDrive / mailbox access. Revoke sessions, remove attacker MFA methods, reset credentials, and re-register methods securely for confirmed compromises.
• Tighten app consent. Restrict user consent, require admin approval, and review service principals with broad Graph permissions such as Mail.Read, Files.Read.All, and Directory.Read.All.

What this is not

It is not a reason to pause passkey rollout. It is a reason to finish the Conditional Access work that makes passkeys, managed devices, and blocked device-code flows the default — and to train helpdesk and users so urgency on a personal phone does not become a session token.

If you want a practical backlog for the lasting controls, see our Microsoft Secure Score Quick-Start Checklist, or the earlier note on what recent Entra disclosures taught us about identity posture.

Sources: Microsoft Security Blog — Passkey-themed social engineering leads to identity and cloud compromise (9 Sep 2026), BleepingComputer summary.