Microsoft has warned that criminal extortion groups are dressing their phishing up as something that sounds reassuring: passkeys and single sign-on. Microsoft says threat actors linked to ShinyHunters, Helix and other extortion gangs are using passkey and single sign-on-themed social engineering to compromise corporate Microsoft accounts and steal data from Microsoft 365 services.
It is worth understanding why that framing works. Staff have been told for years that passkeys and single sign-on are the safer way to log in, so a message about “setting up your passkey” or “re-confirming your sign-in” does not trip the usual alarm bells. It looks like IT doing the right thing. The attacker is not breaking the technology at all; they are talking a person through handing over access to it.
What this means for your business
If your business runs on Microsoft 365 – email, Teams, SharePoint, OneDrive – one compromised account is often enough. Whoever is in that mailbox can read years of correspondence, find your invoices and supplier details, and quietly copy files. Extortion crews do not always bother locking your systems these days. The stolen data is the leverage.
Four practical steps
- Tell your team plainly that a prompt to enrol a passkey or redo a sign-in can be fake, and that nobody from IT will ring and walk them through it out of the blue.
- Agree on one way to check. A quick call to a number your staff already have beats replying to the message that arrived.
- Keep multi-factor authentication switched on, and treat an approval prompt you did not ask for as a warning sign rather than an annoyance to tap away.
- Know who is watching your sign-in logs. Spotting an odd login on the day is the difference between a scare and a serious loss.
None of this takes a big budget. It takes someone having actually looked.
Worried this affects your business? Get a free 15-minute IT check – call Trends IT on 0485 011 911 or visit /contact/.