# Passkey-themed social engineering leads to identity and cloud compromise

DevFeed: [Passkey-themed social engineering leads to identity and cloud compromise](<https://devfeed.tech/articles/passkey-themed-social-engineering-leads-to-identity-and-cloud-compromise-7642.md>)

Original publisher: [Read original article](<https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/>)

Author: Microsoft Security Research, Krithika Ramakrishnan, Bharat Vaghela, Vaibhav Deshmukh, Subhajit Ghosh, Anusha Chakraborty, Akash Chaudhuri, Victor Chingtham and Ivan Macalintal

Published: 2026-09-09T17:41:18Z

Content type: article

Language: en

Sources: [Microsoft Security Blog](<https://devfeed.tech/sources/microsoft-security-blog.md>)

Topics: [MFA](<https://devfeed.tech/topics/mfa.md>), [data-processing](<https://devfeed.tech/topics/data-processing.md>)

Tags: [adversary-in-the-middle-aitm](<https://devfeed.tech/tags/adversary-in-the-middle-aitm.md>), [apis](<https://devfeed.tech/tags/apis.md>), [attacks](<https://devfeed.tech/tags/attacks.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [cloud](<https://devfeed.tech/tags/cloud.md>), [data](<https://devfeed.tech/tags/data.md>), [identity](<https://devfeed.tech/tags/identity.md>), [mfa](<https://devfeed.tech/tags/mfa.md>), [phishing](<https://devfeed.tech/tags/phishing.md>), [security](<https://devfeed.tech/tags/security.md>), [social-engineering](<https://devfeed.tech/tags/social-engineering.md>)

## AI overview

Microsoft Security Research describes a passkey-themed social-engineering campaign that compromises cloud identities through AiTM phishing or device-code flows, establishes authentication persistence, and collects cloud data. It outlines investigation signals and recommends revoking sessions and removing unauthorized authentication methods after confirmed compromise.

## Source excerpt

Passkey-themed social engineering is being used to compromise identities and enable broader cloud attacks. Learn how threat actors establish MFA persistence, abuse Microsoft Graph for reconnaissance, and access SharePoint, OneDrive, and email data, along with key detection and mitigation guidance. The post Passkey-themed social engineering leads to identity and cloud compromise appeared first on Microsoft Security Blog.