From TechRadar · · 1m 20s
Hackers found a way around passkeys
A fake IT help desk call, a follow-up text, and your Microsoft cloud files walk out the door.
In brief
A fake IT help desk call, a follow-up text, and your Microsoft cloud files walk out the door. Passkeys stop password theft, not people. The weak point is now a convincing phone call telling you to re-enroll. Originally reported by TechRadar.
Passkeys killed password theft
Stealing a password no longer gets attackers in. So they switched targets: trick the person into authenticating on a machine the attacker controls.
“Passkeys have made stealing passwords obsolete.”
The homework comes first
Before anyone picks up the phone, the crew builds a profile from LinkedIn and other public sources: employer, job title, personal mobile number.
“The actor appears to invest heavily in pre-attack research”
A call from IT
The victim is told their organization's help desk needs them to update their passkey or MFA right now, or their work will be disrupted.
Then the text arrives
An SMS follows with a link to update security settings. The page mirrors the Microsoft sign-in screen closely enough to pass a quick glance.
The site sits in the middle
It is an adversary-in-the-middle proxy. It either captures credentials or completes the login on the attacker's behalf, handing them a live session.
Files leave the building
Running since at least May, the campaign pulls documents from SharePoint and OneDrive and mail from Exchange Online. Compromised accounts then pitch the same lure over Teams.
“actors take advantage of already compromised accounts to expand their reach”
The key point
Passkeys stop password theft, not people. The weak point is now a convincing phone call telling you to re-enroll.
