Storm-3121 callers demand an urgent passkey update to harvest Microsoft 365 session tokens

The device-code path is the one that breaks user training. An employee reads a code back over the phone and types it into Microsoft's own authentication page, and the grant issues a token to an attacker-controlled OAuth application ^[8][9]. There is no lookalike domain for the employee to check and no password entered into a fake form.

The adversary-in-the-middle path is the older one, and it yields both the password and the session token ^[7]. Microsoft's write-up of one intrusion shows what the token bought. The sign-in came from an unmanaged device to a service Entra logs as OfficeHome, which covers the Office 365 portal's shared infrastructure and browser-based Office apps ^[10][11]. The attacker completed MFA, then started checking what the account could reach ^[12]. Within minutes the session hit My Apps for assigned applications, My Profile, Microsoft Approval Management, account-management interfaces and My Sign-Ins ^[13]. SharePoint Online, Outlook Web, collaboration and search services, an internal business application and authentication flows tied to virtual desktops followed ^[14].

Microsoft says the lures frequently revolve around passkeys and that the attackers are not attempting to enroll one ^[5]. The word is the pretext; the target is a session token or a device-code grant ^[6]. Microsoft does not say the targeted organizations were running passkey rollouts ^[26]. What makes the call land is narrower than a rollout schedule: the employee has heard passkey, MFA and SSO from their own IT department, and the caller says their access is about to break ^[3].

Microsoft published eight example domains, and four of them contain the string passkey: passkeyhelpdesk, secure-passkey, setupmypasskey and add-passkey ^[21][23]. Two are key-sync constructions, keysyncos and oskeysync, and one, oktasession, names an identity provider that is not Microsoft ^[21][23]. The victim company's name usually goes in the subdomain, as in company-name.secure-passkey[.]com ^[22]. On the work that precedes the call, Microsoft wrote: "The actor appears to invest heavily in pre-attack research, likely gathering information about employees and organizational structure from public sources such as social networking and professional profiling platforms" ^[24].

Microsoft puts the initial access with Storm-3121, which it associates with ShinyHunters and Falcon extortion, and Storm-3032, which it ties to BlackFile members now operating under the Helix name ^[16][17]. Google Threat Intelligence has tracked overlapping phone-based social engineering and passkey-themed phishing infrastructure as UNC6671 ^[18]. Google's list of gangs linked to that cluster runs to five: BlackFile, Helix, Falcon, Pink and Redact ^[19][25].