Microsoft says attackers are using fake “passkey update” calls to break into Microsoft 365 accounts. The same pitch also arrives by text, and the lure often lands on a personal phone. The caller claims to be from the IT helpdesk, says a passkey, MFA, or single sign-on setup must be fixed right away, and warns that access will stop.
The goal is usually not a real passkey. Microsoft reports that the story is a cover for adversary-in-the-middle phishing, and device-code tricks sit under the same pretext. Some victims are pushed to lookalike sign-in pages. Others are asked to enter a code on a real Microsoft page, which then hands a token to the attacker. Domain names lean on words like passkey, SSO, and key sync, and the company name often sits in a subdomain.
After a successful sign-in, the attackers dig through Microsoft Graph to map users, groups, apps, and privileges. They pull files from SharePoint and OneDrive, and some cases reach Exchange mail and attachments. Microsoft has also seen new MFA methods added under the attacker’s control, which lets them keep access after the first call ends.
Businesses in Gun Barrel City do not need the full threat-actor taxonomy. They need a simple rule. No one from “IT” should ever ask staff to update a passkey or MFA over a cold call. The same rule covers a text to a personal phone. A real helpdesk verifies the employee first through a known channel. Staff should hang up and call the real number on file.
Microsoft recommends phishing-resistant MFA where you can. Limit sensitive cloud access to managed devices. Turn off device-code authentication if the office does not need it. Watch for odd sign-ins, new MFA registrations after those sign-ins, and heavy SharePoint or OneDrive downloads. If an account is compromised, revoke the open sessions, reset the credentials, remove attacker MFA methods, and make the user re-register cleanly.
A Free Assessment is a practical next step. Call 903-675-5431. Office hours are Monday through Friday, 7:00 a.m. to 6:00 p.m. Contract customers are covered 24/7.
