Storm-3121 callers demand an urgent passkey update to harvest Microsoft 365 session tokens

Microsoft says threat actors linked to ShinyHunters, Helix and other extortion gangs are using passkey and single sign-on-themed social engineering attacks to compromise corporate Microsoft accounts and steal data from Microsoft 365 services.

The activity has been observed since May 2026 and begins with the attackers researching targeted organizations and employees before calling or messaging victims while impersonating corporate IT help desks.

The attackers tell employees that they must urgently update a passkey, MFA or single sign-on configuration to avoid losing access to corporate systems.

Microsoft attributes the initial-access activity to multiple threat actors operating in the same extortion ecosystem, including groups it tracks as Storm-3121 and Storm-3032.

Storm-3121 is associated with ShinyHunters and Falcon extortion, while Storm-3032 is believed to be tied to BlackFile extortion group members that now work under the Helix name.

The threat actors register phishing domains that combine company names with words related to passkeys, SSO, key synchronization, account setup and identity verification.

The attackers commonly place the victim company's name in a subdomain, such as company-name.secure-passkey[.]com, to make the phishing portal appear more convincing.

AiTM attacks allow the threat actors to capture credentials and session tokens.

"The actor appears to invest heavily in pre-attack research, likely gathering information about employees and organizational structure from public sources such as social networking and professional profiling platforms"

Device code phishing tricks victims into authorizing access to their account via an attacker-controlled client using Microsoft's legitimate authentication pages.

In another attack the passkey social engineering led to device-code phishing, where the victim was convinced to enter a supplied code into Microsoft's legitimate authentication page, issuing an authentication token to the attacker-controlled OAuth application.

In one investigated attack, Microsoft observed a suspicious sign-in from an unmanaged device to a Microsoft 365 service identified in Entra logs as "OfficeHome".

OfficeHome is associated with the Office 365 portal's shared infrastructure, including Office applications accessed through a browser.

After completing MFA, Microsoft says the attacker established a valid session and began checking what resources the compromised account could access.

Within minutes, the session was used to access My Apps to see what applications are assigned to the account, My Profile for organizational information, Microsoft Approval Management, account-management interfaces and My Sign-Ins.

The attacker then accessed SharePoint Online, Outlook Web, Microsoft 365 collaboration and search services, an internal business application, and authentication flows associated with virtual desktops.

Microsoft says the session remained active for approximately one hour while the attacker listed sensitive files and internal applications.

The activity overlaps with attacks previously documented by Google Threat Intelligence under the UNC6671 cluster, which Google reported uses phone-based social engineering and passkey-themed phishing infrastructure to compromise corporate identities before accessing enterprise cloud environments.

Google has linked UNC6671 activity to the same extortion gangs, including BlackFile, Helix, Falcon, Pink and Redact.

Google's published list of extortion gangs linked to UNC6671 names five groups.

Microsoft's account covers the lure, the phishing infrastructure and the post-compromise session, and does not state that the targeted organizations were conducting passkey rollouts at the time.

Examples seen by Microsoft include passkeyhelpdesk[.]com, secure-passkey[.]com, setupmypasskey[.]com, add-passkey[.]com, integratedsso[.]com, oktasession[.]com, keysyncos[.]com and oskeysync[.]com.

Of the eight example domains Microsoft listed, four contain the string "passkey", two are key-sync constructions (keysyncos, oskeysync), and one names Okta rather than Microsoft (oktasession).