# Passkeys Were Supposed to Stop Phishing. Attackers Just Made Them the Lure.
When the authentication industry spent three years telling enterprises that passkeys would end phishing, it made one miscalculation: it forgot that attackers read the same marketing materials defenders do.
Microsoft's threat intelligence team disclosed this week that two distinct campaigns hit its cloud ecosystem this summer — one a high-volume CEO impersonation wave that flooded inboxes across five days in early August, the other a precision operation using passkey-themed social engineering to crack open corporate Microsoft 365 environments. Together they illustrate something the credential-security space needs to grapple with honestly: phishing didn't die when passkeys arrived. It evolved.
## A Million Scam Emails in 72 Hours
The first campaign ran August 3–5, 2026, and by Microsoft's count, pushed more than one million fraudulent emails through legitimate third-party sending infrastructure. The attackers impersonated chief executive officers — a classic business email compromise playbook — using real email delivery services to sidestep reputation filters and SPF/DKIM checks that would normally catch spoofed domains.
The mechanics here are worth pausing on. These weren't spoofed headers fired from a residential botnet. The threat actors rented or compromised accounts on trusted bulk email platforms, which meant the sending IP reputation was clean, DKIM signatures validated, and many enterprise spam filters had no statistical basis to flag the traffic. Defender platforms that rely on "is this sender who they claim to be?" as the core filter are flying blind against this class of attack.
The financial fraud angle — impersonating a CEO to pressure employees into wire transfers or gift card purchases — is one of the oldest and most profitable scam categories in cybercrime. The FBI's Internet Crime Complaint Center reports BEC losses consistently exceeding $2 billion annually. A million emails in 72 hours isn't a surgical campaign; it's a volume play designed to convert even a fraction of a percent.
## The Passkey Bait
The second campaign is more technically interesting, and more troubling.
Attackers constructed a social engineering flow built around passkey enrollment — specifically, convincing targets that they needed to set up a passkey on their account for security compliance reasons. This is deceptive at multiple levels.
Passkeys, the FIDO2-based authentication standard backed by Apple, Google, and Microsoft, are genuinely phishing-resistant when used correctly. A passkey bound to login.microsoft.com will not authenticate against a lookalike domain — the cryptographic challenge-response is domain-scoped. Attackers know this. So instead of trying to intercept a passkey handshake (which is largely futile against a properly implemented relying party), they attacked the enrollment process itself.
The technique works by getting a target to add a new passkey or FIDO device to their existing account — ideally one the attacker controls or can access. Once a legitimate user adds an attacker-supplied authenticator to their Microsoft 365 account, the attacker holds persistent access that survives password resets, requires no phishing proxy to maintain, and generates authentication events that look completely normal in audit logs.
It's a clever inversion of the security promise. Passkeys aren't defeated; they're weaponized.
## Cloud Access, Then Exfiltration
Once inside Microsoft cloud environments, the campaign pivot follows a now-familiar script: enumerate mailboxes, identify high-value targets, establish persistence through OAuth app registrations or additional MFA devices, and begin data exfiltration. Microsoft linked this campaign to broader financial fraud objectives, suggesting the cloud access was a means to an end — access to business communications, financial workflows, and vendor relationships that feed downstream fraud.
The third-party email infrastructure angle appears in both campaigns and deserves separate attention. Attackers increasingly rent access to legitimate sending platforms — transactional email providers, marketing automation tools, CRM systems — because these services have earned IP reputation that security products treat as trusted. This is a supply-chain-adjacent problem: the sending infrastructure isn't compromised in the traditional sense, it's just being operated by bad actors using legitimate accounts.
## HackWire Analysis
This disclosure arrives at an important inflection point for enterprise authentication strategy. Organizations that rolled out passkeys over the past two years often did so with an implicit assumption: *we're now phishing-resistant, we can deprioritize other controls*. These campaigns are a direct challenge to that complacency.
The passkey enrollment attack vector isn't novel — security researchers flagged account-takeover-via-authenticator-addition as a risk when FIDO2 deployment guidance was sparse. What's changed is that it's now being operationalized at scale against Microsoft's cloud estate, the largest single attack surface in enterprise computing.
A few things are getting missed in early coverage of this disclosure. First, the third-party email infrastructure abuse compounds over time. As attackers successfully use these platforms, some accounts get burned and banned, but the technique keeps working because the pool of sendable infrastructure is enormous and cheap to cycle through. Defenders who rely on sender reputation are chasing a problem that's structurally unsolvable at their layer.
Second, the CEO impersonation and cloud account campaigns are likely connected operationally even if attributed separately. BEC operations increasingly use compromised cloud environments as reconnaissance engines — reading victim email to understand reporting relationships, financial workflows, and vendor names before launching tailored wire transfer fraud. The two campaigns may be sequential phases of the same operation.
For defenders, the concrete priorities are: audit every registered authenticator and OAuth app in your Microsoft 365 tenant now, not after the next incident. Set conditional access policies that restrict new authenticator enrollment to managed devices or require admin approval. And treat passkey enrollment confirmation emails with the same skepticism you'd apply to password reset flows — because attackers have figured out how to make them look identical.
The authentication industry sold passkeys as a destination. Attackers have already started treating it as terrain.
— HackWire Editorial
---
## Related Coverage