📰 Source: The Hacker News
Summary
Microsoft has disclosed details of two campaigns where threat actors used passkey phishing to breach cloud environments and exfiltrate data. The attackers sent over a million scam emails between August 3 and 5, 2026, masquerading as chief executive officers. These emails exploited third-party email delivery infrastructure to deliver financial fraud scam messages.
Attack Flow
IAM Impact
The passkey phishing campaign highlights the importance of robust identity and access management (IAM) controls. It demonstrates how attackers can exploit users' trust in email communication and their willingness to provide sensitive information, such as passkeys. This attack also emphasizes the need for organizations to implement multi-factor authentication (MFA) and monitor user behavior for suspicious activities.
Key Takeaways
- Implement Multi-Factor Authentication (MFA): Enforce MFA for all users accessing cloud environments to prevent unauthorized access.
- Monitor User Behavior: Regularly monitor user activity to detect suspicious patterns and prevent attackers from using stolen passkeys.
- Secure Email Delivery Infrastructure: Ensure that third-party email delivery infrastructure is secure and does not facilitate phishing campaigns.
Recommendations
- Conduct Regular Security Awareness Training: Educate users about the risks of phishing and the importance of verifying the authenticity of emails before providing sensitive information.
- Implement Passkey Rotation: Enforce regular passkey rotation to reduce the impact of a single compromised passkey.
- Use Conditional Access: Implement conditional access policies to limit access to cloud environments based on user behavior, location, and device.