Microsoft traces four months of Graph-based mail theft to fake passkey helpdesk calls

The two entry paths in Microsoft's account leave different traces. Adversary-in-the-middle puts a proxy between the employee and a page dressed up as the Microsoft sign-in experience, and the actor walks off with credentials and a live session token ^[6][7]. The device code path is quieter: the victim authorizes access on the actor's behalf, so the tenant records an authorization that looks legitimate ^[8]. Either can happen on a personal handset that was never onboarded to Defender for Endpoint, in which case the endpoint tier has nothing to show ^[9]. Microsoft's investigators say the employee's memory of the call is frequently the earliest and sometimes the only evidence of how the intrusion started, and the rest is reconstructed from sign-ins, device code events, token activity and authentication method changes ^[10].

What persists is the authentication method the actor adds to the identity ^[1]. Collection after that is API work: Graph at volume, SharePoint and OneDrive downloads, mail through REST endpoints ^[1]. Microsoft assesses that shape as automated collection from compromised cloud identities behind proxy-associated infrastructure ^[3].

The dates set the exposure window. Activity observed since May 2026 ^[2], guidance dated 9 September 2026 ^[15], so at least four months of operation before publication ^[16].

Sequence-first hunting follows from the infrastructure economics. The actors register generic domains and push the target company's name into the subdomain, so the string reads as familiar in an SMS, and multiple domains per organization allow rotation ^[13]. Those domains are operational within hours ^[13], which puts an indicator feed behind the campaign before it ships. Registrar concentration at Nicenic is a weak signal, and Microsoft explicitly cautions that registration is not evidence of registrar involvement ^[14]. The order of events is what holds: identity compromise, persistence, reconnaissance, content discovery, exfiltration ^[4].

Two gaps in the material are worth naming. Microsoft calls the Graph activity high-volume without publishing a threshold, so the baseline is a local decision ^[17]. And the guidance carries no actor name, no state attribution and no victim count ^[18], which makes it a technique advisory rather than a campaign attribution. Lures also lean on SSO enrollment, account activation and identity verification themes, not passkeys alone ^[20], and the targeting is informed by research off public professional profiles ^[19].

The practical join is narrow. Authentication method registration events, correlated with a risky sign-in and with Graph or SharePoint download volume for the same principal inside a short window, gives you the sequence Microsoft describes across the five signal sources it names ^[11].