Attackers compromise Microsoft 365 through Entra Passkey scammers

Introduction: A new sophisticated threat in the cybersecurity landscape

The cyber threat landscape continues to evolve at an alarming rate, with attackers constantly finding new and ingenious ways to bypass traditional security measures. In 2026, cybersecurity researchers identified a highly sophisticated attack campaign targeting users Microsoft 365, exploiting precisely the modern authentication mechanisms that organizations have adopted to increase their security. Attackers use fake passkey registration pages Microsoft It enters to compromise accounts and gain unauthorized access to the targeted organizations' infrastructure. This tactic is a worrying development, as it exploits users' trust in FIDO2 and passwordless authentication technologies, previously considered among the most secure authentication methods available.

What is a Microsoft What is Passkey and why is it a target for attackers?

Microsoft Entra, formerly known as Azure Active Directory is the central identity and access management platform for the ecosystem. Microsoft 365. Passkeys integrated into Microsoft Entra are FIDO2 credentials that allow passwordless authentication, relying on public-key cryptography to eliminate vulnerabilities associated with traditional passwords. When a user registers a passkey, their device generates a pair of cryptographic keys: the private key remains securely stored on the device (often protected by a hardware element such as a TPM or Secure Enclave), and the public key is transmitted to and stored on the servers of the Microsoft Enters.

It is this perception of superior security that makes passkeys an attractive target for attackers. Users who have adopted passwordless authentication tend to be less vigilant, considering themselves protected against traditional phishing. But attackers have identified a critical window of vulnerability: the moment a new passkey is registered. If a user can be tricked into registering a passkey on a platform controlled by the attackers, the entire security scheme collapses, giving the victim complete access to their account.

Anatomy of the attack: How Entra Passkey spoofing works

Stage 1: Initiation of contact and social pretext

The attack campaign usually begins with a well-developed social engineering technique. Victims receive emails or notifications that appear to come from their organization's IT department or directly from Microsoft, asking them to update their authentication methods to comply with new security policies. The messages are carefully crafted to mimic official communications Microsoft, including authentic logos, email formats similar to real ones, and sender addresses that, at a superficial glance, appear legitimate. The artificial urgency created in these messages (“Your account will be blocked in 24 hours if you do not update your credentials”) amplifies the psychological pressure on the victim and reduces the time for critical reflection.

Step 2: Fake Passkey registration page

Once the victim accesses the link in the message, they are redirected to a web page that faithfully imitates the authentic interface of the portal. Microsoft Enters. These fake pages are hosted on legitimate-looking domains, sometimes using typosquatting techniques or subdomains containing trusted keywords. like "microsoft”, “enter”, “login” or “secure”. The fake page initiates an apparent flow of registering a new passkey, asking the user to follow the standard steps: verifying identity, authorizing the device and confirming the registration.

From a technical point of view, the attack works through a mechanism of type Adversary-in-the-Middle (AiTM)The attacker's server acts as a proxy between the victim and the authentic services. Microsoft, intercepting sessions and authentication tokens in real time. By capturing valid session cookies and OAuth tokens, the attacker can take control of the account without knowing the victim's password or having physical possession of the victim's device. This approach is particularly dangerous because it bypasses traditional multi-factor authentication (MFA) based on SMS or TOTP applications.

Step 3: Recording the attacker-controlled passkey

After intercepting the authenticated session, the attacker proceeds to register his own passkey in the victim's account through the portal. Microsoft Enter legitimately. This action gives the attacker a persistent and difficult-to-detect authentication method., because the passkey appears in the logs as a legitimate addition of credentials by the authorized user. From now on, the attacker can access the account Microsoft 365 account whenever they want, without generating suspicious authentication alerts, because it uses a strong authentication method, recognized and approved by the system.

Impact on the ecosystem Microsoft 365

Compromise of an account Microsoft 365 through an unauthorized passkey gives the attacker access to a vast ecosystem of corporate data and services. Among the resources on display are:

Exchange Online and all your email, calendars, and contacts stored on SharePoint and OneDrive, along with your organization's sensitive documents and filesMicrosoft Teams, which can contain confidential conversations and shared filesIntegrated applications through Azure AD, including CRM, ERP systems or platforms cloud third partyAccess to Azure Resource Manager if the account has administrative permissionsThe ability to launch lateral attacks against other users in the organization

A particularly worrying aspect is that the attacker, once consolidated in the ecosystem, can use the compromised account to launch subsequent internal phishing campaigns, exploiting the trust that the victim's colleagues place in communications originating from a familiar and verified address. This privilege escalation and lateral movement turns a single compromised account into an entry point for an organizational-wide security breach.

Evasion and persistence techniques used by attackers

Camouflage in logs and avoid detection

One of the reasons this campaign is particularly dangerous is the attackers' ability to avoid detection by traditional monitoring systems. Because access is achieved through a valid passkey, authentication events are recorded as normal activities., without any obvious indicators of compromise. Security teams that have not implemented specific monitoring of the registration of new authentication methods risk missing this malicious activity. Attackers can plan accesses outside of business hours or from geographic locations that, although different from the victim's usual ones, do not trigger poorly configured conditional access policies.

Infrastructure use cloud legitimate

Another evasion tactic observed in this campaign consists of use of services cloud legitimate for hosting phishing pagesAttackers have resorted to platforms such as Azure Static Web Apps, Cloudflare Pages or other reputable hosting services to avoid blacklisting malicious domains. The presence of a valid TLS certificate and a reputable hosting domain prevents security solutions based on URL reputation from flagging these pages as threats. Furthermore, some of these pages have implemented fingerprinting techniques to detect accesses from sandbox environments or from IP addresses associated with security solutions, displaying harmless content in these cases and the phishing page only to real users.

Distribution vectors and preferred targets

Researchers have identified several vectors through which victims are lured to fake passkey registration pages. The main attack vectors include:

Email spear-phishing campaigns, personalized for each target organization

Direct messages via Microsoft Teams, sent from previously compromised accounts

Paid ads on social media platforms that mimic official communications Microsoft

Redirects from compromised websites that inject popups or redirects

• Smishing SMS messages claiming to be from technical support Microsoft

As for the targets, the campaign appears to be targeting organizations in the financial, healthcare, public administration, and technology sectors, i.e., domains with high data value and significant regulatory pressure to adopt modern authentication. System administrator and executive accounts are prime targets due to the extended privileges associated with them.

Protective measures and expert recommendations

Configuring Conditional Access Policies

The first line of defense consists of implementing and correctly configuring conditional access policies in Microsoft Entra ID. Organizations should configure policies that restrict the registration of new authentication methods only from Compliant Devices and trusted network locations. This measure prevents the scenario where an attacker who has obtained a valid session token can register a passkey from an arbitrary location. It is also recommended to implement the “Authentication Methods” policy at a granular level, clearly defining who can register which types of credentials and under what conditions.

Monitoring credential registration events

Security teams (SOC) must implement specific alerts for events recording new authentication methods, especially for passkeys and FIDO2 keys. In Microsoft Entra ID, these events are recorded in Audit Logs under the “Authentication Methods” category. Configuring real-time alerts for these events, correlated with analysis of location, device, and previous user behavior, can enable early detection of suspicious activity. Integration with a SIEM (Security Information and Event Management) solution allows correlation of these events with other indicators of compromise.

User education and awareness

The human aspect remains critical in combating these attacks. Users should be instructed to be extremely cautious when receiving requests to update authentication methods., even if they appear to come from legitimate sources. They should always check the URL of the registration page, contact the IT department directly if in doubt, and not follow links in unsolicited emails for sensitive security operations. Phishing simulations that include passkey phishing scenarios can help raise awareness among employees.

Implementing the Privileged Identity Management principle

For accounts with high privileges, Microsoft Entra Privileged Identity Management (PIM) provides an additional layer of protection by implementing just-in-time access and manual approval for activating administrative roles. This measure significantly reduces an attacker's window of opportunity even in the event of an administrative account being compromised, because elevated privileges are not permanently active and require additional approval for activation.

Implications for Zero Trust architecture

This attack campaign highlights an important lesson for organizations implementing Zero Trust architectures: no authentication technology, no matter how advanced, is immune to manipulation through social engineering. The principle of “never trust, always verify” must be extended beyond technical credential verification to include validation of the full context of every access request and, in particular, every change to authentication methods. Mature Zero Trust architectures include continuous behavioral monitoring, real-time risk assessment, and the ability to revoke access instantly when anomalies are detected.

Organizations should treat the passkey registration process with the same level of care and control as any other critical administrative operation., implementing approval flows, out-of-band notifications, and additional identity checks for these sensitive actions.

Conclusion: The continuous evolution of cyber threats

Phishing campaign with fake passkeys for Microsoft Entra represents clear evidence that attackers are quickly adapting to evolving security technologies, sometimes transforming security innovation itself into an attack vector. Adopting passwordless authentication and FIDO2 passkeys remains the right and recommended direction, but organizations must understand that technical implementation alone is not enough. The success of a security strategy depends on the combination of robust technology, correct configuration, continuous monitoring and a well-developed organizational security culture. As threats become increasingly sophisticated, investing in the continuing education of cybersecurity professionals is becoming not an option, but a strategic necessity for any organization that wants to protect its digital assets.

Surely you understood what the news in 2026 is related to cybersecurityIf you are interested in deepening your knowledge in the field, we invite you to explore our range of courses structured by roles and categories in Cybersecurity HubWhether you're just starting out or want to brush up on your skills, we have a course for you.