Microsoft links passkey-themed phishing to ShinyHunters and Helix extortion crews

Microsoft says threat actors tied to the ShinyHunters, Helix and other extortion gangs have used passkey- and single sign-on-themed social engineering since May 2026 to compromise corporate Microsoft accounts and steal data from Microsoft 365 services. Attackers research targets, then call or message employees while impersonating IT help desks and urge urgent passkey, MFA or SSO updates. Microsoft says the lures do not enroll a passkey; they push victims to adversary-in-the-middle phishing sites or device-code authentication flows that capture credentials and session tokens. Microsoft attributes the activity to groups it tracks as Storm-3121 and Storm-3032, overlapping with Google's UNC6671 cluster.