# The Phishing Lure Is Now the Passkey
There is a particular cruelty to what ShinyHunters and their associated extortion crews are pulling off right now. The technology industry spent years telling enterprise security teams that passkeys would end phishing — cryptographic authentication, device-bound keys, no credentials to steal. And those teams listened. They're in the middle of rolling passkeys out to hundreds of thousands of corporate users who have no idea what a passkey enrollment prompt is supposed to look like, and can't tell the real one from a fake.
That's the attack surface. That's where the threat actors are living.
Microsoft has confirmed that groups affiliated with ShinyHunters, Helix, and affiliated extortion operators are running social engineering campaigns built around passkey and single sign-on themes, targeting corporate Microsoft accounts and pulling data out of Microsoft 365 environments. The technical sophistication of the campaign is secondary to the strategic insight behind it: the window when users are learning new authentication flows is exactly when attackers should be teaching them the wrong ones.
## The Mechanics of the Con
Passkey-themed phishing doesn't require breaking cryptography. It doesn't need to. The attack operates upstream of any cryptographic guarantee.
The most likely mechanism — consistent with how adversary-in-the-middle (AiTM) infrastructure works — is a convincing fake portal that mimics Microsoft's passkey enrollment or sign-in flow. Users receive a pretext: an urgent notification about securing their account, a forced migration to passkey-based authentication, a single sign-on prompt that looks exactly like the real Entra ID (formerly Azure AD) login page. They interact with it. The proxy sitting in the middle lifts the session token in real time, before the victim realizes anything is wrong.
Session token theft is important to understand here. Even in environments where passkeys or MFA are properly configured on the real Microsoft side, an AiTM attack doesn't try to break those controls — it steals the authenticated session *after* the user completes legitimate authentication through the proxy. The cryptographic handshake happened. The cookie landed. The attacker has it.
That's the gap the SSO framing exploits. Single sign-on means one successful session token unlocks email, Teams, SharePoint, OneDrive, and anything else in the Microsoft 365 tenant. One phishing interaction. Everything.
## ShinyHunters' Resume, and Why It Matters Here
ShinyHunters is not a fresh name in this industry. This is the same group — or at least the same brand, with the same associated infrastructure and extortion methodology — behind the 2024 Snowflake customer breach campaign that burned AT&T, Ticketmaster, Advance Auto Parts, and dozens of others. The playbook in that campaign was different on the surface (infostealer credentials rather than social engineering) but identical in structure: find the cloud service at the center of enterprise data storage, compromise authentication, exfiltrate at scale, extort.
Microsoft 365 is the Snowflake of the identity and collaboration world. Snowflake held data warehouses. Microsoft 365 holds email threads, Teams messages, legal documents, HR records, financial planning files, M&A discussions, and the identity infrastructure that governs who gets access to what. If anything, it's a richer target.
Helix's involvement signals this isn't a one-crew operation. Multiple extortion groups converging on the same infrastructure class — cloud-hosted Microsoft environments — suggests a maturing attack economy where successful techniques spread laterally through the threat actor community. When ShinyHunters finds a productive vector, adjacent groups adapt it. That's how the Scattered Spider/ALPHV collaboration worked against MGM and Caesars in 2023. The social engineering playbook gets shared, refined, and reused.
## The Transition Window Is the Vulnerability
Enterprise security teams need to absorb an uncomfortable truth: authentication transitions are inherently high-risk periods, and vendors don't stress this nearly enough.
When Microsoft pushes passkey adoption, they're asking organizations to change the learned behavior of their entire workforce simultaneously. Employees who've spent years typing passwords, then clicking MFA prompts, now have to learn a new interaction model — biometrics, device prompts, different UI flows depending on platform. That relearning process creates exactly the kind of uncertainty attackers exploit.
"Does this prompt look right?" is a question millions of corporate users will ask themselves over the next 18 months. Attackers are betting that enough of them will decide yes and proceed.
The parallel to SIM-swapping attacks against SMS-based MFA is instructive. When companies pushed users toward SMS authentication, attackers immediately began impersonating carriers and users to intercept codes. The solution (authenticator apps, hardware keys, now passkeys) arrived, and the attack surface shifted upstream to the enrollment and adoption process itself. Every authentication improvement generates a corresponding social engineering attack targeting the transition.
---
## HackWire Analysis
The conventional read on this campaign is: phishing is getting more sophisticated. That framing misses the real story.
What ShinyHunters is demonstrating is that the attack surface for enterprise authentication doesn't move with the cryptography — it moves with the *human layer*, and the human layer is always at its most vulnerable during change. This isn't about breaking passkeys. Passkeys remain cryptographically sound. It's about the six-to-eighteen month window every large organization will spend partially enrolled, with users who don't know what legitimate prompts look like and IT desks fielding confusion tickets that make "I got a weird Microsoft prompt" easy to dismiss.
The Microsoft 365 angle compounds the risk in a way other reporting is underemphasizing. Entra ID is also the identity backbone for thousands of organizations using SSO to authenticate into third-party SaaS — Salesforce, Workday, ServiceNow, industry-specific platforms. A single compromised M365 session token doesn't just open the tenant; in many enterprise configurations, it propagates. Defenders who think they're managing a Microsoft breach may actually be managing a much wider blast radius.
Three things defenders should prioritize right now: First, deploy phishing-resistant MFA via FIDO2 hardware keys or platform passkeys — but audit whether your *enrollment* flow can be spoofed, because that's where this attack lives. Second, implement conditional access policies that flag impossible travel and session anomalies aggressively; AiTM-stolen tokens will often surface here. Third, brief your SOC on the specific lure: passkey enrollment urgency, SSO migration prompts, account security notifications. These are the pretexts. Pattern-match against them in your phishing simulation program before attackers teach your users first.
The industries most exposed are the ones furthest into Microsoft 365 dependency with the least mature identity governance: mid-market professional services, regional healthcare systems, and law firms. These organizations standardized on M365 for the productivity, not the security. They're passkey-curious but not passkey-deployed. And they are the exact profile of organizations that paid ransoms in 2023 and 2024.
ShinyHunters knows this. They've seen the victim list.
— HackWire Editorial
---
## Related Coverage