Plan
active
Passkey Phishing Campaigns Target Microsoft Cloud Accounts at Scale
- Engineer — Learn: Demonstrates that passkey-themed social engineering can bypass MFA assumptions — worth factoring into how passkey enrollment flows and conditional access policies are hardened, but no CVE or patch action follows from this disclosure.
- SOC/IR — Plan: The active campaign pattern — CEO-impersonation lures leading to passkey/cloud credential harvesting — is worth building detections around: hunt for anomalous passkey registration events in Entra ID and tune email-gateway rules for third-party-relayed CEO impersonation at volume.
- Leader — Learn: Useful context that passkey adoption does not eliminate cloud account takeover risk; informs future board or customer messaging about layered identity controls, but no vendor breach or regulatory trigger here.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.