Passkey-themed phishing attacks lead to Microsoft 365 data theft

A series of coordinated cyberattacks are targeting Microsoft 365 accounts through a combination of social engineering and specialized phishing tools. According to reports from BleepingComputer and Microsoft, these attacks utilize passkey-themed phishing to lead to the theft of cloud data and the compromise of user identities. The operation involves the use of the N0va Phishkit, which eSecurity Planet reports is specifically targeting users across North America and Europe by mimicking Microsoft login interfaces to deceive victims into providing their credentials. The coverage emphasizes a sophisticated multi-channel approach to breach corporate security. Help Net Security and Dark Reading report that attackers are making direct voice calls to the personal phones of employees.

These voice callers are exploiting Bring Your Own Device (BYOD) policies to gain a foothold, using the personal nature of the communication to build trust or urgency before attempting to break into Microsoft 365 accounts. This blend of telephonic social engineering and digital phishing allows attackers to bypass traditional security layers that might otherwise flag a standard email-only phishing attempt. This trend is significant because it targets the trust associated with passkeys, which are generally seen as a more secure alternative to traditional passwords. By framing the attack around passkeys, the threat actors can manipulate users into performing actions that compromise their identity and cloud storage. The use of the N0va Phishkit suggests a structured infrastructure designed for scale, focusing on high-value regions in Europe and North America where Microsoft 365 is widely deployed for corporate operations and the storage of sensitive organizational data.

Future developments to monitor include the evolution of the N0va Phishkit and whether the targeting expands beyond North America and Europe. Based on current reports from Microsoft and other security outlets, the primary risk remains the intersection of BYOD vulnerabilities and the social engineering of employees via their personal mobile devices. Organizations will likely need to evaluate how voice-based attacks can circumvent existing identity protections. The industry is now watching for updated guidance on preventing passkey-themed deception from leading to full cloud compromise.