Passkey-themed phishing attacks lead to Microsoft 365 data theft

A new wave of phishing attacks is targeting Microsoft 365 accounts, utilizing passkey-themed social engineering to facilitate identity and cloud compromise. According to reports from BleepingComputer and Microsoft, these campaigns are designed to steal data from cloud environments. The attacks specifically employ a tool known as the N0va Phishkit, which eSecurity Planet reports is currently targeting users across North America and Europe. These operations focus on manipulating users into providing credentials or access through deceptive Microsoft login interfaces. Coverage from Help Net Security and Dark Reading emphasizes a specific tactic where attackers place voice calls to the personal phones of employees.

This approach exploits Bring Your Own Device (BYOD) policies to bridge the gap between a user's personal hardware and their corporate Microsoft 365 account. By leveraging these phone calls, attackers are able to bypass traditional security perimeters and reach sensitive corporate data. These outlets highlight that the human element of social engineering remains a primary vulnerability even as technical authentication methods evolve. This trend is significant because it targets passkeys, which are generally viewed as a more secure alternative to traditional passwords. The shift toward passkey-themed phishing indicates that attackers are adapting their narratives to match current security trends to better deceive employees.

By mimicking the language of modern authentication and using direct voice communication, the actors are able to create a sense of urgency and legitimacy. The use of the N0va Phishkit demonstrates a structured approach to targeting specific geographic regions including Europe and North America. Future developments will likely center on how organizations mitigate the risks associated with BYOD and personal phone usage in the corporate authentication chain. Since Microsoft has explicitly linked these passkey-themed social engineering efforts to cloud compromise, monitoring for unusual login activity within Microsoft 365 environments will be critical. The focus remains on the intersection of voice-based social engineering and the exploitation of cloud identities to gain unauthorized access to corporate datasets.