The threat actors spoof executive leaders, seek fund transfers, capture credentials, and register authentication methods to exfiltrate sensitive data
Hackers have been abusing trusted services and social engineering to phish for cloud access keys: one sent more than 1m fraudulent emails seeking payments, while the other used passkey-themed lures to compromise cloud accounts and steal data.
The first operation had run from 3 August to 5 August 2026 and impersonated company CEOs in messages aimed at accounts-payable teams.
The attackers sought ACH transfers for a supposedly legitimate annual ServiceNow subscription. Their targets were primarily US organizations in IT services, consumer goods, real estate and discrete manufacturing.
The operators appear to have used generative AI to prepare recipient-specific templates and emails. The campaign had combined spoofed executive identities, trusted email infrastructure, fake invoices, vendor branding and fabricated approval threads. The messages used the names and email addresses of CEOs, CFOs and presidents, while lookalike domains included [service-nowinc[.]com] and [domainlify[.]net]
The second campaign, observed since May 2026, targeted Microsoft cloud identities. Attackers contacted employees through calls or text messages, posing as IT help-desk staff and claiming that users needed to update passkey, multifactor authentication or single sign-on settings to prevent service interruptions.
Victims were directed to counterfeit Microsoft sign-in pages and pushed through adversary-in-the-middle or device-code authentication flows. These methods could capture credentials or persuade users to authorize access without realizing it. The attackers also conducted extensive reconnaissance before targeting victims, using public information about employees and organizational structures. In some cases, compromised accounts were used to distribute similar messages through Microsoft Teams.
Threat groups linked to the heist
The threat actors registered domains themed around passkeys, identity verification and SSO enrollment, including:
- passkeyhelpdesk[.]com]
- [secure-passkey[.]com]
- [setupmypasskey[.]com]
- [add-passkey[.]com]
- [integratedsso[.]com]
- [oktasession[.]com]
- [syncmykey[.]com]
- [portalsetuphub[.]com]
Target-specific subdomains were used to make the sites appear more credible.
Microsoft has linked the activity to several threat groups, including Storm-3121 and Storm-3032, and said it overlaps with infrastructure associated with Cordial Spider, O-UNC-045, PREY-0058 and UNC6671.
After gaining access, attackers had attempted to establish persistence by registering their own phone number, authenticator app or software-based one-time-password token. They then used Microsoft Graph to map users, groups, permissions and services; searched mailboxes and attachments; downloaded data from SharePoint, OneDrive and Exchange; and maintained exfiltration for hours or days.
The attackers rotated infrastructure and IP addresses between authentication, reconnaissance and theft, making isolated indicators less useful.
