Threat actors linked to ShinyHunters, Helix, and other extortion groups are running a wave of social-engineering attacks that spoof passkey setup screens and single sign-on prompts to steal Microsoft 365 credentials from corporate employees. Microsoft’s security researchers have been tracking the activity and published their findings on Thursday, noting that the groups are specifically targeting large enterprises where a compromised account can yield the sensitive documents and internal communications that fuel their extortion operations.
The technique works by sending a target an apparently legitimate passkey authentication or device authorization request — formatted to look exactly like a real Microsoft prompt. When the victim interacts with it, they are redirected through an attacker-controlled relay that captures their credentials and session cookie in real time, defeating most forms of multi-factor authentication in the process. By combining fake passkey lures with device code phishing — an OAuth flow that some legacy applications still permit — the attackers can gain persistent access to Microsoft 365 environments including SharePoint, OneDrive, Teams, and email. ShinyHunters, which has been behind numerous large-scale database breaches, and Helix, a newer group focused on corporate extortion, are both among the actors Microsoft identified using these methods.
How to check if you’re affected
Affected products include Microsoft 365 Business, Enterprise, and Government plans. If you or your employees have recently received an unexpected passkey setup request, single sign-on prompt, or device authorization code that arrived outside a normal IT workflow, treat it as suspicious. Security teams should review their conditional-access policies to block device code authentication flows where not operationally required, and audit recent OAuth consent grants for unfamiliar applications.