Passkey-themed social engineering enables M365 identity and cloud compromise

Thu, 10 Sep 2026 14:58:06 +0000

Engineer — Plan: No exploitation-pressure signals, but the MFA persistence and Microsoft Graph abuse techniques described warrant auditing Entra ID registered authentication methods for unexpected passkey enrollments and reviewing conditional access policies governing Graph API access this quarter.
SOC/IR — Act: The article documents TTPs mappable to ATT&CK — MFA persistence registration and Microsoft Graph reconnaissance — against a near-universal enterprise target (M365); implement or tune detections for anomalous Graph API enumeration calls and unexpected MFA method additions, and hunt for such activity since early September 2026.
Leader — Plan: Passkey rollout communications are now a social engineering attack surface; if your organization is mid-deployment, review user-facing passkey enrollment messaging for impersonation risk and include this TTP in the next security-awareness training update.

Identity-and-Access on CuraSec