Microsoft has tracked passkey- and SSO-themed help desk impersonation since May 2026, with the calls steering employees into adversary-in-the-middle proxies and device-code grants that hand over live Microsoft 365 sessions.
Perspective Coverage
3 publishers
- Builder
- Builder 25%
- Operator
- Operator 63%
- Investor
- Investor 12%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+10
- Incentives35
- Confidence70
Cisco Talos links China-nexus UAT-11587 to 16 affected or targeted institutions in eight Asian countries, via a backdoor run through Microsoft 365. Its commands move through Outlook and OneDrive via Microsoft Graph, so defenders have no command server to block.
Perspective Coverage
3 publishers
- Builder
- Builder 32%
- Operator
- Operator 63%
- Investor
- Investor 5%
Reality
- Evidence62
- Adoption30
- Hype gap+8
- Incentives
- Not scored
- Confidence65
Microsoft's Digital Crimes Unit and its partners pulled down the EvilTokens phishing service about seven months after it launched, and British police arrested its two suspected operators. The authentication technique it sold survives on other platforms.
Perspective Coverage
8 publishers
- Builder
- Builder 25%
- Operator
- Operator 60%
- Investor
- Investor 15%
Reality
- Evidence66
- Adoption58
- Hype gap+18
- Incentives62
- Confidence64
A 5,700-account Microsoft 365 spray in Chile broke only unrotated service accounts
Proofpoint tracked three waves of TeamFiltration password spraying against Microsoft 365 tenants in Chile between July 21 and August 16. The seven accounts that opened were all functional identities carrying provisioned passwords with no MFA.
Reality
- Evidence50
- Adoption60
- Hype gap+10
- Incentives65
- Confidence55
EvilTokens phishing kit abused device code sign-in to compromise 12,000 inboxes
Microsoft says the phishing-as-a-service platform reached more than 12,000 inboxes at over 10,000 organizations in seven months by abusing a legitimate OAuth flow, and its Digital Crimes Unit has now disrupted the infrastructure behind the service.
Reality
- Evidence58
- Adoption62
- Hype gap+20
- Incentives76
- Confidence57
GraphWorm answers token revocation by swapping its own OAuth credentials
CSO Online's teardown of a Webworm implant found an upgrade command that replaces all five credential strings in a single task. The revocation step at the top of most identity runbooks costs the operator one poll cycle.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+15
- Incentives22
- Confidence56
DavMail 7.0.0 asks restricted tenants to approve a new Graph scope before shared calendars open
The Java gateway now requests Calendars.ReadWrite.Shared, drops davmail.caldavImpersonate, turns folder delta sync on by default and makes anyone moving from EWS to Graph sign in again. In tenants that vet app permissions, consent comes before rollout.
Reality
- Evidence58
- Adoption15
- Hype gap+8
- Incentives30
- Confidence60
Revoking the stolen tokens left GhostCode's Intune device inside the tenant
eSentire says a phishing kit called GhostCode used Microsoft's device-code flow to register three devices within 77 seconds of a victim completing MFA, and one of them stayed enrolled in Intune until it was explicitly removed.
Reality
- Evidence58
- Adoption30
- Hype gap+12
- Incentives60
- Confidence55
Fake helpdesk calls use the passkey rollout as the pretext for Microsoft 365 intrusions
Microsoft has tracked intrusions since May in which callers posing as IT told employees a passkey update was due, then steered them to a phishing page or a device-code prompt. The enrollment step is where the chain starts.
Reality
- Evidence55
- Adoption35
- Hype gap−5
- Incentives60
- Confidence58
Click-time code generation strips the 15-minute limit out of device code phishing
Microsoft's researchers describe a device code phishing campaign that minted fresh codes the moment a target clicked, defeating the expiry that used to hold these attacks down. The flow it abuses is only needed by hardware that cannot show a login page.
Reality
- Evidence55
- Adoption45
- Hype gap+20
- Incentives65
- Confidence60
buildOne report1 publisher A passkey 'upgrade' call ends with the attacker's phone number registered as an MFA method
Microsoft Security Research describes callers posing as IT staff to get a Microsoft 365 session relayed or minted to their own client. The lasting damage comes from the MFA method they then register.
Reality
- Evidence55
- Adoption40
- Hype gap+15
- Incentives55
- Confidence55
buildOne report1 publisher Claude for Windows ships Entra Continuous Access Evaluation switched on by default
RuntimeWire's comparison of two shipped Claude for Windows builds found CAE markers, a local authentication broker and sovereign-cloud handling, while Microsoft's published certification record for Claude still answers No on CAE.
Reality
- Evidence62
- Adoption22
- Hype gap+20
- Incentives52
- Confidence58
Fake IT callers register their own MFA method under the Microsoft 365 identities they phish
Microsoft has tracked this since May 2026. First contact lands on an unmanaged personal phone, and the attacker's own authenticator outlives the stolen session, so tenant telemetry only starts after the account is already lost.
Reality
- Evidence55
- Adoption45
- Hype gap−10
- Incentives65
- Confidence58
Microsoft traces four months of Graph-based mail theft to fake passkey helpdesk calls
Since May, intruders posing as IT have walked employees through a passkey update on their personal phones, then registered their own authentication method and pulled mail and files through Graph, SharePoint and Exchange APIs.
Reality
- Evidence62
- Adoption32
- Hype gap+12
- Incentives65
- Confidence58
buildOne report1 publisher A winget-shaped YAML workflow takes the PIM step out of routine Intune app updates
RelayPublisher publishes YAML manifests as Intune line-of-business apps straight from CI, which relocates the right to write apps in your tenant from a human's time-boxed elevation to a pipeline credential that holds it permanently.
Reality
- Evidence34
- Adoption8
- Hype gap+18
- Incentives66
- Confidence41
Three items, one tier: Keycloak's reset bug, an N-able password leak, a Grok data-theft trick
A single Stormcast episode carries a Keycloak 26.7.2 password-reset fix, a reported N-able password manager leak, and a published LLM safeguard bypass. Most of it sits in the identity and secrets tier.
Reality
- Evidence52
- Adoption
- Not scored
- Hype gap+14
- Incentives34
- Confidence55
buildOne report1 publisher Bind the consent policy, not the admin role: Entra's answer to the agent consent queue
A custom directory role scoped to one app consent policy lets a delegate approve tenant-wide consent only inside a named envelope. The queue does not vanish; it becomes policy maintenance.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+14
- Incentives
- Not scored
- Confidence58
The extortion call now comes from your help desk, and the fix is a procedure you own
Google says the BlackFile crew has targeted dozens of organisations by phoning staff and posing as internal IT. No vendor bug is involved, which puts the remedy on IT leadership.
Reality
- Evidence70
- Adoption42
- Hype gap+8
- Incentives62
- Confidence58
buildOne report1 publisher Three permission problems wearing one service principal: why published agents return 403
A Foundry governance walkthrough splits agent permissions into on-behalf-of reads, unattended agent identity, and human approval. Collapsing them into one credential is a publish-time failure.
Reality
- Evidence42
- Adoption
- Not scored
- Hype gap+8
- Incentives30
- Confidence40