Microsoft's threat intelligence teams have published a critical warning this week: threat actors are running passkey-themed social engineering campaigns that don't steal credentials in the traditional sense — they trick users into adding attacker-controlled authentication credentials to their own accounts. The result is durable MFA persistence, full identity takeover, and follow-on compromise of SharePoint, OneDrive, and Exchange Online data, with Microsoft Graph abused as the reconnaissance and collection engine.
This is a significant escalation in identity attack tradecraft. For years, defenders treated passkeys and FIDO2 credentials as the phishing-resistant endgame. This campaign proves that even strong authentication is only as strong as the enrollment ceremony — if a user can be socially engineered into registering a new passkey or completing a device code flow initiated by an attacker, the adversary inherits that phishing resistance for free. Your SOC needs detections for authentication-method additions, Graph API enumeration, and anomalous cloud data access today.
Technical Analysis
The Attack Chain
Based on Microsoft's reporting, the intrusion chain follows a consistent pattern:
1. Passkey-themed lure. The victim receives a phishing message themed around passkey setup, security upgrades, or IT-mandated MFA enrollment. The lure directs them to an attacker-controlled flow — typically a lookalike Entra ID authentication experience or a device code authentication prompt — where the victim unknowingly authorizes the attacker's device or registers an attacker-controlled passkey/security credential on their account.
2. MFA persistence via attacker-registered authentication methods. Once the victim completes the flow, the threat actor has a durable credential on the account. Because this is a legitimate registered authentication method, subsequent attacker sign-ins satisfy MFA requirements cleanly — no MFA fatigue prompts, no anomalous-push alerts, nothing for a user to deny. This is the critical persistence mechanism and the highest-value detection point.
3. Reconnaissance via Microsoft Graph. With a valid session and tokens, the actor pivots to Graph API enumeration — querying users, groups, directory roles, group memberships, and application permissions to map the tenant. This recon is often scripted, frequently via Microsoft Graph PowerShell SDK (Connect-MgGraph, Get-MgUser, Get-MgGroupMember) or direct Graph REST calls, and is characterized by high-volume directory reads in a compressed time window.
4. Data access and collection. The actor then accesses SharePoint sites, OneDrive content, and mailbox data using the compromised identity's legitimate permissions. Because access is scoped to what the victim could already reach, DLP and access alerts often don't fire — the traffic looks like the user, from an unusual place, at an unusual time, with unusual volume.
Why This Technique Is Dangerous
- No CVE, no patch. This is abuse of legitimate identity features — device code flow, security info registration, Graph API. There is no vulnerability to patch; the fix is configuration, detection, and user hardening.
- Phishing-resistant MFA is bypassed by enrollment, not by interception. Traditional AiTM phishing kits proxy credentials and tokens. This approach sidesteps that entirely by making the attacker's authenticator a legitimate credential.
- Persistence survives password resets. A compromised password can be changed; an attacker-registered passkey or security key persists until explicitly removed. IR that resets the password but doesn't audit authentication methods leaves the door open.
- Graph recon blends with admin tooling. Microsoft Graph PowerShell is a legitimate administrative tool. Detection requires behavioral context — volume, timing, source — not binary signatures.
Exploitation Status
Microsoft confirms this is an observed, active campaign in the wild — not theoretical tradecraft. There is no associated CVE and no CISA KEV entry; this is a technique-class threat requiring detection engineering and policy controls rather than patching.
Detection & Response
The three highest-fidelity detection surfaces are: (1) new authentication method registration, (2) Graph API enumeration behavior, and (3) anomalous cloud data access. Below are production-ready analytics for each.
---
title: Microsoft Graph PowerShell SDK Authentication and Directory Enumeration
description: Detects interactive or scripted use of Microsoft Graph PowerShell cmdlets commonly used by threat actors for tenant reconnaissance following identity compromise. Legitimate admin use exists; tune with an allowlist of known admin workstations and service accounts.
references:
- https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/
- https://attack.mitre.org/techniques/T1069/
- https://attack.mitre.org/techniques/T1087/
author: Security Arsenal
date: 2026/09/12
status: experimental
tags:
- attack.discovery
- attack.t1087
- attack.t1069
logsource:
category: process_creation
product: windows
detection:
selection_process:
Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
selection_cmdlets:
CommandLine|contains:
- 'Connect-MgGraph'
- 'Get-MgUser -All'
- 'Get-MgGroupMember'
- 'Get-MgDirectoryRole'
- 'Get-MgSubscribedSku'
- 'Invoke-MgGraphRequest'
selection_scope:
CommandLine|contains:
- '-Scopes'
condition: selection_process and (selection_cmdlets or selection_scope)
falsepositives:
- Legitimate identity administrators using Graph PowerShell SDK
- Automated provisioning and reporting scripts
level: medium
---
title: New Security Info or Authentication Method Registered on Azure AD Account
description: Detects registration of new authentication methods (passkeys, FIDO2 security keys, phone sign-in, authenticator) on Azure AD / Entra ID accounts. The core persistence mechanism in passkey-themed social engineering campaigns — attacker-registered credentials survive password resets.
references:
- https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/
- https://attack.mitre.org/techniques/T1098/
author: Security Arsenal
date: 2026/09/12
status: experimental
tags:
- attack.persistence
- attack.t1098
logsource:
product: azure
service: auditlogs
detection:
selection:
OperationName|contains:
- 'User registered security info'
- 'Add strong authentication phone device'
- 'Add FIDO2 security key'
- 'User started security info registration'
condition: selection
falsepositives:
- New employee onboarding and legitimate MFA enrollment — correlate with onboarding dates and enrollment policies
- User-driven credential rotation
level: high
---
title: Device Code Flow Authentication From Unusual Source
description: Detects sign-ins to Azure AD / Entra ID using the device code authentication protocol, a flow abused in passkey-themed social engineering to capture sessions on attacker-controlled devices without credential phishing infrastructure.
references:
- https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/
- https://attack.mitre.org/techniques/T1528/
author: Security Arsenal
date: 2026/09/12
status: experimental
tags:
- attack.initial_access
- attack.t1528
- attack.t1078
logsource:
product: azure
service: signinlogs
detection:
selection:
authentication_protocol: 'deviceCode'
condition: selection
falsepositives:
- Azure CLI and Azure PowerShell device-code authentication in environments where interactive browser auth is blocked
- IoT and kiosk device enrollment
level: medium
// Hunt: New authentication method registration followed by sign-in from a new IP/ASN within 24h
// This is the signature of attacker-registered MFA persistence after passkey social engineering.
let Registrations = AuditLogs
| where TimeGenerated > ago(14d)
| where OperationName has_any ("User registered security info", "Add FIDO2 security key", "Add strong authentication phone device")
| extend TargetUser = tostring(TargetResources[0].userPrincipalName)
| extend RegIP = tostring(InitiatedBy.user.ipAddress)
| extend RegMethod = tostring(AdditionalDetails)
| project RegTime = TimeGenerated, TargetUser, RegIP, OperationName, RegMethod;
SigninLogs
| where TimeGenerated > ago(14d)
| where ResultType == 0
| join kind=inner Registrations on $left.UserPrincipalName == $right.TargetUser
| where TimeGenerated between (RegTime .. RegTime + 24h)
| where IPAddress != RegIP
| summarize SigninCount = count(),
Apps = make_set(AppDisplayName),
IPs = make_set(IPAddress),
Locations = make_set(Location)
by UserPrincipalName, RegTime, OperationName
| order by RegTime desc;
// Hunt: High-volume Microsoft Graph directory reads — reconnaissance behavior
// Flags accounts making bulk Graph calls for user/group/directory enumeration in a short window.
SigninLogs
| where TimeGenerated > ago(7d)
| where AppDisplayName has_any ("Microsoft Graph PowerShell", "Microsoft Graph Command Line Tools")
or ResourceDisplayName == "Microsoft Graph"
| summarize GraphCalls = count(),
FirstSeen = min(TimeGenerated),
LastSeen = max(TimeGenerated),
SourceIPs = make_set(IPAddress),
UserAgents = make_set(UserAgent)
by UserPrincipalName, bin(TimeGenerated, 1h)
| where GraphCalls > 50
| order by GraphCalls desc;
// Hunt: Bulk SharePoint/OneDrive file downloads by a single identity
// Collection behavior after identity compromise — volume and velocity are the discriminators.
CloudAppEvents
| where TimeGenerated > ago(7d)
| where Application has_any ("SharePoint Online", "OneDrive")
| where ActionType in ("FileDownloaded", "FileSyncDownloadedFull")
| summarize DownloadCount = count(),
DistinctFiles = dcount(ObjectName),
Sites = make_set(RawEventData.SiteUrl),
IPs = make_set(IPAddress)
by AccountDisplayName, bin(TimeGenerated, 1h)
| where DownloadCount > 100 or DistinctFiles > 50
| order by DownloadCount desc;
-- Hunt for Microsoft Graph PowerShell SDK execution on endpoints
-- Identifies interactive or scripted Graph recon following identity compromise.
-- Review for processes not tied to known admin workstations or automation accounts.
SELECT Pid,
Name,
CommandLine,
Exe,
Username,
CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)Connect-MgGraph|Get-MgUser|Get-MgGroup|Invoke-MgGraphRequest|Get-MgDirectoryRole'
OR CommandLine =~ '(?i)Microsoft\.Graph'
-- Hunt for device code flow artifacts in PowerShell history files
-- Attackers using Graph/Azure SDK device code auth leave traces in console history.
LET history_files = SELECT FullPath, Mtime, Size
FROM glob(glob='C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadLine\\ConsoleHost_history.txt')
SELECT FullPath,
Mtime,
Size,
read_file(filename=FullPath, length=100000) AS HistoryContent
FROM history_files
WHERE HistoryContent =~ '(?i)Connect-MgGraph|UseDeviceAuthentication|DeviceCode|Get-MgContext'
#Requires -Modules Microsoft.Graph.Identity.SignIns, Microsoft.Graph.Reports
# Passkey Social Engineering — Tenant Audit and Hardening Script
# Run as Global Admin / Security Admin with AuditLog.Read.All + Policy.Read.All consent
Connect-MgGraph -Scopes "AuditLog.Read.All","Directory.Read.All","Policy.Read.All" -NoWelcome
# ---- 1. Audit: Find all authentication method registrations in the last 14 days ----
$cutoff = (Get-Date).AddDays(-14).ToString("yyyy-MM-ddTHH:mm:ssZ")
$regs = Get-MgAuditLogDirectoryAudit -Filter "activityDateTime ge $cutoff" -All |
Where-Object { $_.ActivityDisplayName -match "security info|FIDO2|strong authentication" }
$regs | Select-Object ActivityDateTime, ActivityDisplayName,
@{N='TargetUser';E={$_.TargetResources[0].UserPrincipalName}},
@{N='InitiatedBy';E={$_.InitiatedBy.User.UserPrincipalName}},
@{N='SourceIP';E={$_.InitiatedBy.User.IPAddress}} |
Export-Csv -Path ".\AuthMethodRegistrations_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
Write-Host "[+] Found $($regs.Count) auth method registrations — review CSV for unexpected enrollments" -ForegroundColor Yellow
# ---- 2. Audit: Find all device code flow sign-ins in the last 14 days ----
$deviceCodeSignins = Get-MgAuditLogSignIn -Filter "createdDateTime ge $cutoff" -All |
Where-Object { $_.AuthenticationProtocol -eq "deviceCode" }
$deviceCodeSignins | Select-Object CreatedDateTime, UserPrincipalName, IPAddress,
AppDisplayName, @{N='Location';E={"$($_.Location.City), $($_.Location.CountryOrRegion)"}} |
Export-Csv -Path ".\DeviceCodeSignins_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
Write-Host "[+] Found $($deviceCodeSignins.Count) device code sign-ins — validate against known CLI usage" -ForegroundColor Yellow
# ---- 3. Report: Users with passkeys/security keys registered (inventory baseline) ----
$users = Get-MgUser -All -Property Id,UserPrincipalName
$fidoInventory = foreach ($u in $users) {
$methods = Get-MgUserAuthenticationFido2Method -UserId $u.Id -ErrorAction SilentlyContinue
foreach ($m in $methods) {
[PSCustomObject]@{ User = $u.UserPrincipalName; MethodId = $m.Id; Created = $m.CreatedDateTime }
}
}
$fidoInventory | Where-Object { $_.Created -gt (Get-Date).AddDays(-14) } |
Export-Csv -Path ".\RecentFIDO2Registrations.csv" -NoTypeInformation
Write-Host "[+] $($fidoInventory.Count) FIDO2/passkey methods inventoried — RecentFIDO2Registrations.csv shows last 14 days" -ForegroundColor Yellow
# ---- 4. Harden: Verify authentication methods policy restricts passkey registration ----
$fidoPolicy = Get-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `
-AuthenticationMethodConfigurationId "Fido2"
Write-Host "[i] FIDO2 policy state: $($fidoPolicy.State)" -ForegroundColor Cyan
Write-Host "[i] REVIEW: Enable Conditional Access authentication strength requirements for security info registration" -ForegroundColor Cyan
# ---- 5. Response: Remove a confirmed attacker-registered auth method (uncomment to execute) ----
# Remove-MgUserAuthenticationFido2Method -UserId "<user-id>" -Fido2AuthenticationMethodId "<method-id>"
# Revoke-MgUserSignInSession -UserId "<user-id>" # Revokes all refresh tokens
Disconnect-MgGraph
Remediation
Immediate Response (If Compromise Is Suspected)
- Audit authentication methods before resetting passwords. Enumerate every registered credential on affected accounts (passkeys, FIDO2 keys, Authenticator entries, phone methods). Remove any method the user doesn't recognize. Then reset the password and revoke all sessions — order matters, because an attacker credential left behind survives the reset.
- Revoke all tokens and sessions. Use
Revoke-MgUserSignInSessionor the Entra portal to invalidate refresh tokens. For confirmed compromise, also revoke app consent grants and review enterprise application permissions. - Scope the blast radius via Graph activity. Pull sign-in logs for Microsoft Graph PowerShell, Azure CLI, and the Graph Explorer applications from the compromise window. Review SharePoint/OneDrive/Exchange audit logs for file downloads, sharing link creation, and mailbox access by the compromised identity.
- Hunt laterally. The recon output tells you what the attacker knows. If they enumerated admin group membership, assume privileged accounts are next on the target list and preemptively audit those accounts' authentication methods.
Strategic Hardening
- Gate security info registration behind Conditional Access. Require a compliant device, trusted location, or phishing-resistant authentication strength for the registration action itself using the "Register security information" user action in Conditional Access. This is the single most effective control against this technique.
- Constrain or block device code flow. Create a Conditional Access policy targeting the device code authentication flow — block it entirely unless your environment has a documented need (CLI-only scenarios), and scope exceptions tightly.
- Use Temporary Access Pass (TAP) for onboarding. Controlled, time-limited, single-use TAP enrollment eliminates the window where users can be tricked into an attacker-orchestrated enrollment ceremony.
- Alert on authentication method changes. The AuditLogs rule above should be a production alert, not just a hunt query. New security info registration on any account — especially privileged ones — warrants same-day review.
- Baseline Graph usage. Know which admins legitimately use Graph PowerShell and from which workstations. Anything outside that baseline is an investigation.
- Train users on the enrollment ceremony specifically. Standard phishing training tells users not to enter passwords. This campaign works because users believe passkey setup is safe. Teach them: your IT department will never send you a link to register a passkey on demand — enrollment only happens through documented onboarding workflows.
Vendor Reference
Full technical details from Microsoft's investigation are available in the source advisory: Microsoft Security Blog — Passkey-themed social engineering leads to identity and cloud compromise
Bottom Line
Passkeys didn't fail here — the enrollment process did. Attackers have adapted to phishing-resistant MFA by attacking the moment a credential is born, not the moment it's used. If your monitoring can't answer the question "when was the last authentication method added to this account, and by whom, from where," you have a blind spot that this campaign is actively exploiting. Close it this week.
Related Resources
Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.