Microsoft passkey social engineering campaign targets cloud data exfiltration

This campaign demonstrates how attackers are weaponizing the industry-wide shift toward passkeys by using them as psychological lures to bypass traditional MFA. For streaming platforms and media enterprises, the systematic abuse of the Microsoft Graph API for reconnaissance means that standard API calls can mask large-scale data theft if not monitored holistically. The transition from identity compromise to high-volume exfiltration in SharePoint and OneDrive highlights a critical vulnerability in how cloud-based production and distribution workflows are secured. Organizations must now prioritize phishing-resistant FIDO2 credentials and strict conditional access to prevent automated scripts from traversing sensitive internal repositories. Watch for increased adoption of Graph activity logging as a baseline requirement for enterprise security posture.

Microsoft's broader threat intelligence apparatus has been tracking Storm-3121 as part of a wider pattern of identity-focused attacks against cloud tenants. In early 2026, Microsoft's Defender team published guidance on how threat actors abuse OAuth consent grants to gain persistent access to Microsoft 365 environments, a technique that shares the same Graph API reconnaissance chain observed in the Storm-3121 campaign. The overlap signals that passkey-themed lures are not isolated phishing experiments but part of a maturing playbook where initial access brokers hand off compromised tokens to specialized exfiltration crews. Microsoft Defender for Cloud Apps has since added detection policies specifically flagging anomalous Graph API enumeration patterns, according to Microsoft's updated Defender for Cloud Apps documentation released in July 2026.