UNKNOWN: Active cloud intrusions use passkey/MFA/SSO help-desk lures to drive AiTM or device-code authentication, compromise sessions/tokens, add authentication methods, perform Graph reconnaissance and access M365 content.
حد الدليل: Passkey protocol flaw, one actor/campaign, representative prevalence, or that every service access event equals exfiltration.
UNKNOWN: Multiple recent IR engagements show targeted help-desk vishing and fake passkey/MFA enrollment leading to session theft or attacker authenticator enrollment, Graph tenant inventory and rapid SharePoint/OneDrive/mailbox collection; one executive case generated >100,000 FileAccessed events in a burst consistent with library cloning.
حد الدليل: 100,000 unique exfiltrated files, universal actor identity, population prevalence, or residential-IP legitimacy.
UNKNOWN: UNC6671 uses help-desk vishing, AiTM SSO compromise, attacker-controlled MFA registration and automated Microsoft 365/Okta/SaaS data theft; replayed session cookies can retrieve content in ways recorded as FileAccessed rather than FileDownloaded.
حد الدليل: That all passkey-themed campaigns are UNC6671, that every FileAccessed event is exfiltration, or cross-vendor actor identity.
UNKNOWN: Arctic Wolf tracks widespread PREY-0058 IT-impersonation/vishing that bypasses MFA through social engineering, gains Microsoft 365/SaaS access and performs rapid automated data exfiltration followed by extortion; overlap with UNC6671 is reported without identity equivalence.
حد الدليل: PREY-0058 equals UNC6671 or every extortion brand, or representative prevalence.
المتابعة المفتوحة
OPEN [HIGH]: ACTOR_CAMPAIGN_IDENTITY — UNC6671/BlackFile, PREY-0058, Microsoft Storm labels and The-Com-linked operators cannot be safely merged from shared vishing/AiTM/SaaS-exfiltration tradecraft.
OPEN [HIGH]: PREVALENCE_CONTROL_EFFECTIVENESS — No representative denominator or controlled multi-environment dataset quantifies prevalence or comparative effectiveness of phishing-resistant MFA/device-bound passkeys, managed-device CA, device-code restrictions and strict security-info registration.
المصادر
Microsoft Security Researchhttps://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/