Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data

Microsoft disclosed two campaigns where threat actors abuse third-party email infrastructure to send financial fraud scams and use passkey-themed social engineering to breach cloud environments. The first campaign sent over a million scam emails between August 3 and 5, 2026, masquerading as chief executive officers to hijack Microsoft cloud accounts and exfiltrate data.