When the Passkey Rollout Becomes the Phishing Lure, the Credential Is the Problem

Week of 21 September 2026 | Compiled by Team Paringa

The industry told users passkeys would end phishing. This week Microsoft documented attackers using the passkey rollout itself as the pretext to take over cloud accounts, and a commodity phishing kit showed how a single legitimate sign-in yields tokens that unlock the whole tenant.

What Happened This Week

🔴 Microsoft confirms passkey-themed social engineering is leading to full Entra tenant compromise, with attacker-registered MFA as the persistence mechanism

Microsoft Security Research has disclosed an active campaign, observed since May 2026, in which threat actors call or text employees' personal phones posing as the corporate IT help desk and insist that their passkey, MFA or SSO configuration must be updated immediately to avoid losing access. Victims are steered by SMS to counterfeit Microsoft sign-in pages and guided through either an adversary-in-the-middle (AiTM) flow, which proxies the real Entra login and captures the resulting session, or a device-code flow in which the victim unknowingly authorises the attacker's device. Microsoft attributes the initial-access activity to Storm-3121 and Storm-3032 (the latter tracked elsewhere as UNC6671), groups feeding the ShinyHunters, Falcon and Helix extortion brands.

The infrastructure is built for the pretext. Registered domains include passkeyhelpdesk[.]com, secure-passkey[.]com, setupmypasskey[.]com, add-passkey[.]com, integratedsso[.]com and, notably, oktasession[.]com, each with the target company's name prepended as a subdomain. In a smaller number of cases attackers used already-compromised accounts to push the same lure internally over Microsoft Teams.

What happens next is the important part. Microsoft says the actor's first objective after access is to turn a temporary compromise into a persistent foothold by enrolling an MFA method they control, typically a new phone number, authenticator app or software OTP token. That actor-owned second factor lets them sign in to the corporate account without the victim's participation for as long as sessions remain unrevoked. From there Microsoft observed Graph API reconnaissance of users, groups and roles, mailbox enumeration, high-volume SharePoint Online and OneDrive downloads, and exfiltration lasting hours to days, with separate IP addresses used for authentication, reconnaissance and exfiltration to defeat network indicators. In one case the actor used the passkey lure to run a device-code attack that took the account without stealing any credential or cookie at all.

Sources: The Hacker News, Microsoft Security Blog

Read the domain list again: attackers are impersonating both the Entra and the Okta enrolment experience because both share the same weak point. The identity provider issues something, a session, a token, a registered second factor, and whatever is issued can be proxied, replayed or re-enrolled by whoever is on the phone with your user. Passkeys are phishing-resistant at the protocol level, but the enrolment, recovery and fallback paths around them are not, and that is where this campaign lives. The control question for IAM leads is not "have we rolled out passkeys" but "can a help-desk call still result in a new authentication method on a user's account". If yes, the attacker has a durable second factor and your conditional access is now protecting them. Credential-free authentication changes the equation because there is no credential issued to phish, no session to proxy and no fallback method to enrol; the only path is the one the organisation designed.

🟡 N0va phishing kit hits US and EU organisations, turning one legitimate login into SSO access across the tenant

Researchers at ANY.RUN detailed N0va, a phishing kit active against organisations in government, technology, consulting and healthcare across North America and Europe. The lures impersonate Microsoft Teams, SharePoint, OneDrive, DocuSign, Google Drive, Dropbox, Zoom and Adobe Sign. Rather than serving a fake login page, N0va pushes the victim through a genuine authentication flow, most often device-code phishing, so the identity provider sees a valid sign-in and issues real access and refresh tokens.

The kit then captures those tokens and abuses token-exchange or device-registration mechanisms to establish single sign-on access to email, files and connected cloud applications. The chain is: trusted-brand lure, device-code phishing, legitimate authentication, token capture, token exchange or device registration, SSO access to corporate resources. Because no malware executes and the sign-in is genuine, endpoint tooling and most conditional-access policies see nothing wrong.

The same week, the NIST and CISA joint report NIST IR 8587 was published in final form, giving implementation guidance on protecting the signed tokens and identity assertions that underpin SSO, federation and API access, covering token validation, secrets management and detection at scale. That a US federal standard now exists specifically for token theft tells you how mainstream this attack class has become.

Sources: The Hacker News, SecurityWeek (NIST IR 8587)

N0va is the commodity version of what Microsoft described above, sold by subscription, and it works against Entra and Okta tenants alike because it never touches the password. The victim authenticates correctly, MFA passes, and the identity provider hands the attacker a refresh token that can outlive the phishing page by weeks. If your detection story for account takeover is "impossible travel and failed MFA prompts", this attack generates neither. IAM leads should be reviewing device-code flow exposure (disable it where it is not needed), refresh-token lifetimes and continuous access evaluation this week. The structural fix is to stop issuing a transferable artefact in the first place: a credential-free model where the authentication is bound to the person and the moment, with nothing left over to exchange.

🟡 Two breaches, one root cause: stolen credentials reused at Revolut and over-privileged sign-in tokens at OpenAI

Revolut confirmed that its Lithuanian bank subsidiary handed over identity documents, contact details and financial information on roughly 680 high-value customers over five months in response to fake law-enforcement requests. The attacker did not exploit a vulnerability. They used infostealer logs containing a legitimate Italian Ministry of the Interior employee's email credentials (Hudson Rock reports more than 300 compromised credentials tied to that domain) and simply asked. A $3 million ransom demand followed on 16 September.

At OpenAI, researchers at Hacktron chained an image-processing bug in the company's Discourse-based community forum with a flaw in OpenAI's own sign-in system: tokens generated for forum login carried excessive permissions and granted full API access to linked ChatGPT and Codex accounts. Using a taken-over employee account whose Codex integration was linked to OpenAI's GitHub organisation, the researchers opened a pull request in an internal repository before stopping. OpenAI fixed the token scoping within 14 hours and paid a $6,500 bounty, but until then any employee who had logged in to the forum could have had their accounts, and by extension connected GitHub, Slack and email, taken over.

Sources: SecurityWeek (Revolut), SecurityWeek (OpenAI)

Different organisations, different sophistication, identical failure: a credential or token existed, it was copied, and it was accepted as proof of identity somewhere else. The Italian civil servant's mailbox password was in a stealer log for anyone to buy; OpenAI's forum token was minted with more power than the forum needed. Every stored, replayable secret is a liability that accrues interest, and the average enterprise has thousands of them across employees, partners and machine identities. The commercial point for CISOs is that credential hygiene programmes are a treadmill. Removing the credential removes the treadmill.

What CISOs and IAM Leads Are Dealing With

The identity conversation has moved past "do we have MFA" and even past "have we deployed passkeys". This week's evidence shows attackers treating the entire identity lifecycle as attack surface: the enrolment call, the fallback SMS, the device-code prompt, the refresh token, the recovery flow, the over-scoped SSO token from a peripheral app. Both major enterprise identity platforms are being impersonated by name in attacker infrastructure, because both issue artefacts that can be proxied, exchanged or re-registered once a human is talked into cooperating.

For UK and European IAM leads this is compounding an already heavy year: Microsoft's own move to make passkeys the default Entra sign-in creates a change window attackers are actively exploiting, DORA and NIS2 expect demonstrable identity controls for privileged and third-party access, and regulators investigating the Revolut incident will want to know why a five-month credential-led collection was invisible. The defensible position is shifting from "we authenticate strongly" to "we issue nothing that can be stolen".

Three Things Worth Watching Next Week

1. Microsoft's Entra passkey-default migration - As legacy SMS and voice users are moved across, expect a spike in help-desk-themed vishing that piggybacks on the genuine change. Brief your service desk and users that no one will ever call to "update" a passkey.

2. Device-code flow restrictions in conditional access - Both the Microsoft campaign and N0va lean on device-code authentication. Watch for guidance and tenant defaults changing, and audit which of your apps genuinely need it.

3. Regulatory follow-through on Revolut - Lithuanian and UK supervisors will be examining how a lawful-disclosure process ran for five months on a stolen credential. The findings will shape what "adequate identity verification" means for regulated firms under DORA and the UK Cyber Security and Resilience Bill.

Questions? hello@paringa.ai

Paringa helps CISOs and IAM leads move from strong authentication to credential-free authentication: no credential issued, nothing to phish, proxy or replay, delivered with our partner Symania as part of a managed identity and security wrapper. | 21 September 2026 | © Paringa Ltd