Adversaries Weaponize Passkey Rollouts in Advanced Cloud Identity Hijacking Campaigns

Microsoft Security Research published findings uncovering a sophisticated threat campaign where attackers exploit the enterprise rollout of passkeys to hijack cloud accounts and maintain persistence. Threat actors configure fraudulent infrastructure mimicking corporate Single Sign-On (SSO) and passkey verification workflows. Utilizing phishing emails and compromised Microsoft Teams accounts, adversaries lure employees into authenticating through Adversary-in-the-Middle (AiTM) setups or approving legitimate OAuth device-code flows. Once authenticated, attackers harvest session tokens, query tenant configurations via the Microsoft Graph API, and register their own FIDO2 authenticators on the victim's account to secure persistence across Exchange Online, SharePoint, and OneDrive. This activity highlights a severe operational risk: while passkey cryptography itself remains resilient against credential theft, the administrative onboarding lifecycle presents a major attack surface. By tricking employees into executing device-code flows under the pretense of security compliance, attackers obtain tokens that bypass MFA without triggering conventional endpoint telemetry—particularly when interactions occur on unmanaged mobile devices. The subsequent registration of attacker-controlled FIDO2 credentials allows persistent administrative or user access that completely survives standard password resets and basic session revocations. This campaign reflects a broader architectural shift across cloud and identity security. As identity providers mandate multi-factor authentication and phase out legacy protocols, threat actors have shifted their focus upstream toward session hijacking, OAuth authorization misuse, and identity management tampering. Adversaries recognize that identity perimeter controls are only as robust as the initial trust-establishment phase. Exploiting trusted internal communication channels such as Microsoft Teams demonstrates how attackers leverage internal workplace trust to circumvent edge email gateway protections. Practitioners and DevSecOps teams must implement immediate defensive guardrails around authentication enrollment. Identity administrators should enforce Conditional Access policies that strictly require compliant, managed devices for registering new MFA methods and passkeys. Furthermore, organizations should disable or heavily restrict OAuth 2.0 device-code flows where not explicitly required by developer workflows. Security operations centers (SOCs) should deploy automated hunting rules in Azure and Entra audit logs to flag anomalous FIDO2 key registrations, especially when paired with rapid Graph API enumeration and atypical data access patterns.