# Passkey-Themed Help Desk Phishing Hijacks Microsoft 365 Cloud Accounts for Data Exfiltration

> Storm-3121 and Storm-3032 (UNC6671/Cordial Spider), initial-access brokers feeding the ShinyHunters/BlackFile/Helix/Falcon/Redact/Pink extortion ecosystem, impersonate corporate IT help desks by phone or SMS to trick employees into completing passkey/MFA "migrations" via adversary-in-the-middle or device-code authentication flows, then abuse the Microsoft Graph API to enumerate and mass-exfiltrate SharePoint, OneDrive, and Exchange Online data for extortion. A related campaign sent over one million AI-generated, executive-impersonation invoice-fraud emails between August 3-5, 2026 targeting accounts payable departments.

- **Published:** 2026-09-13T00:00:00Z
- **Last reviewed:** 2026-09-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2472
- **ID:** TL-2026-2472
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** Storm-3121
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Since at least May 2026, Microsoft has tracked Storm-3121 and Storm-3032 running a passkey-themed social-engineering campaign against Microsoft 365 tenants. Operators call or text employees on personal mobile devices, impersonating internal IT help desk staff and claiming an urgent, mandatory passkey, MFA, or SSO update is required. Victims are walked through a counterfeit Microsoft sign-in page that stages either an adversary-in-the-middle (AiTM) reverse-proxy phishing flow — capturing credentials and session tokens in real time — or a device-code authentication flow, in which the victim unknowingly authorizes the attacker's device. Storm-3032 is a splinter of the BlackFile extortion brand now operating as Helix; Storm-3121 leads into the ShinyHunters/Falcon extortion pipeline. Both funnel into the same loose-knit UNC6671 (aka Cordial Spider, PREY-0058) cybercrime collective, which has run parallel extortion brands (BlackFile, Redact, Pink, Helix, Falcon) off shared phishing infrastructure and identical templates since emerging in January 2026.

After initial compromise, the actors register attacker-controlled MFA methods (PhoneAppOTP authenticator entries, software tokens tagged 'SoftwareTokenActivated', phone- and email-based MFA) to persist access even if the original credential is reset. They then conduct systematic reconnaissance via the Microsoft Graph API — profiling the tenant (/organization, /subscribedSkus), enumerating directory objects (/users, /groups, /members, /transitiveMembers), mapping privilege (/directoryroles, /roleManagement, /authentication/methods) and applications (/applications, /servicePrincipals, /oauth2PermissionGrants), then pivoting into repository discovery (/sites, /drives, /drive/items, /search) and mailbox enumeration (/messages, /mailFolders, /attachments). Because each individual Graph call resembles legitimate application traffic, Microsoft notes the abuse 'rarely appears suspicious when viewed through a single API call' and requires cross-event correlation to detect. High-volume, automated collection follows — file and email access sustained over hours to multiple days, throttled below roughly 1,000 files/hour to avoid triggering volumetric alerts, frequently using the python-httpx user agent for downloads. The actors deliberately rotate IP infrastructure across the attack lifecycle, using separate source IPs for authentication, reconnaissance, and exfiltration, and route traffic through residential and commercial proxy services. Once data is staged, defense-evasion cleanup follows: password-reset confirmations, security notifications, and MFA-change alert emails are deleted from the victim mailbox to delay detection. Exfiltrated SharePoint, OneDrive, and Exchange data is handed to extortion brands (ShinyHunters, Helix, Falcon, Redact, Pink) for ransom demands; Bitcoin tracing between January 7 and May 12, 2026 alone attributed 141.65 BTC (~$10.69M) in payments to the ecosystem, with initial demands of $1-3M typically settling near $750,000 after negotiation.

A parallel, related campaign run by the same actor ecosystem used generative AI to draft and personalize over one million executive-impersonation invoice-fraud emails sent between August 3-5, 2026, spoofing CEOs and a ServiceNow annual-subscription-renewal pretext to solicit fraudulent ACH payments from U.S. accounts-payable departments, using attacker-registered lookalike domains and fabricated invoice threads. UNC6671's broader targeting has evolved over 2026 from manufacturing, real estate, healthcare, and insurance (April-May) through technology, transportation, and hospitality (June) to financial services, private equity, law firms, and financial rating agencies (July onward), spanning North America, Australia, and the UK.

## MITRE ATT&CK

- T1591 Gather Victim Org Information
- T1598.003 Phishing for Information: Spearphishing Link
- T1583.001 Acquire Infrastructure: Domains
- T1585.002 Establish Accounts: Email Accounts
- T1566.004 Phishing: Spearphishing Voice
- T1078.004 Valid Accounts: Cloud Accounts
- T1557 Adversary-in-the-Middle
- T1528 Steal Application Access Token
- T1556.006 Modify Authentication Process: Multi-Factor Authentication
- T1070.008 Indicator Removal: Clear Mailbox Data
- T1087.004 Account Discovery: Cloud Account
- T1069.003 Permission Groups Discovery: Cloud Groups
- T1526 Cloud Service Discovery
- T1114.002 Email Collection: Remote Email Collection
- T1213.002 Data from Information Repositories: SharePoint
- T1530 Data from Cloud Storage
- T1020 Automated Exfiltration
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data](https://thehackernews.com/2026/09/attackers-use-passkey-phishing-to.html)
- [Passkey-themed social engineering leads to identity and cloud compromise](https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/)
- [UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data](https://thehackernews.com/2026/08/unc6671-vishing-attacks-target-personal.html)
- [UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments](https://cloud.google.com/blog/topics/threat-intelligence/unc6671-targets-financial-services-and-enterprise-cloud-environments/)
- [Passkey-themed phishing attacks lead to Microsoft 365 data theft](https://www.bleepingcomputer.com/news/security/passkey-themed-phishing-attacks-lead-to-microsoft-365-data-theft/)
- [IT help-desk vishing tricks executives into handing over Microsoft 365 access](https://www.helpnetsecurity.com/2026/09/08/vishing-microsoft-365-data-theft-extortion/)
- [Arctic Wolf Releases Cordial Spider/PREY-0058 Report of IT Help Desk Vishing for Cloud Data Theft and Extortion](https://rhisac.org/threat-intelligence/arctic-wolf-releases-cordial-spider-prey-0058-report-of-it-help-desk-vishing-for-cloud-data-theft-and-extortion/)
- [New BlackFile extortion group linked to surge of vishing attacks](https://www.bleepingcomputer.com/news/security/new-blackfile-extortion-gang-targets-retail-and-hospitality-orgs/)
- [Vishing group UNC6671 now focuses on extorting M&A firms](https://www.scworld.com/news/vishing-group-unc6671-now-focuses-on-extorting-ma-firms)
- [Helix, a New Name in the Data Extortion Ecosystem?](https://reliaquest.com/blog/threat-spotlight-helix-new-name-in-data-extortion-ecosystem/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2472