TOPIC
Current help-desk/passkey-themed social engineering that drives AiTM or device-code/session compromise, attacker-controlled authentication-method persistence, Graph reconnaissance and cloud/SaaS collection; explicitly separates passkey lure from passkey vulnerability and keeps actor clusters distinct absent identity proof.
1
4
2
4
2
NEW — independent Microsoft/CERT/IR/threat-intelligence sources establish active cloud-identity compromise, MFA persistence and SaaS collection/exfiltration. Passkey weakness, unified actor identity, representative prevalence and generalized control-effectiveness remain unproven.
IDENTITY_INTRUSION_RESEARCH_TOPIC
—
—
—
Passkey/MFA help-desk vishing combined with AiTM or device-code/session compromise is a current real-world path to cloud identity takeover and subsequent SaaS data access.
Representative prevalence; victim-level chain attribution; actor/campaign identity mapping.
Attacker-controlled MFA/authentication-method enrollment can convert an initial session or credential compromise into durable cloud identity persistence unless sessions/tokens and unauthorized methods are revoked or removed.
Multi-environment containment outcomes and token/auth-method lifecycle evidence.
مرجع SSOT مسجل، لكن الرابط الداخلي مخفي حتى تفعيل حماية Admin.
Related Topics
Related Domains
الإجمالي: 4 Evidence
Active cloud intrusions use passkey/MFA/SSO help-desk lures to drive AiTM or device-code authentication, compromise sessions/tokens, add authentication methods, perform Graph reconnaissance and access M365 content.
لا يثبت: Passkey protocol flaw, one actor/campaign, representative prevalence, or that every service access event equals exfiltration.
فتح Run المصدرMultiple recent IR engagements show targeted help-desk vishing and fake passkey/MFA enrollment leading to session theft or attacker authenticator enrollment, Graph tenant inventory and rapid SharePoint/OneDrive/mailbox collection; one executive case generated >100,000 FileAccessed events in a burst consistent with library cloning.
لا يثبت: 100,000 unique exfiltrated files, universal actor identity, population prevalence, or residential-IP legitimacy.
فتح Run المصدرUNC6671 uses help-desk vishing, AiTM SSO compromise, attacker-controlled MFA registration and automated Microsoft 365/Okta/SaaS data theft; replayed session cookies can retrieve content in ways recorded as FileAccessed rather than FileDownloaded.
لا يثبت: That all passkey-themed campaigns are UNC6671, that every FileAccessed event is exfiltration, or cross-vendor actor identity.
فتح Run المصدرArctic Wolf tracks widespread PREY-0058 IT-impersonation/vishing that bypasses MFA through social engineering, gains Microsoft 365/SaaS access and performs rapid automated data exfiltration followed by extortion; overlap with UNC6671 is reported without identity equivalence.
لا يثبت: PREY-0058 equals UNC6671 or every extortion brand, or representative prevalence.
فتح Run المصدرCross-layer correlation of authentication-method registration, session/token anomalies, Graph reconnaissance and abnormal cloud-content activity is stronger than isolated IP/domain/user-agent/FileDownloaded-only signals.
Measured detection outcomes, false-positive baselines and sequence analytics across independent tenants.
Cross-layer correlation of appliance file-operation/webshell signals, vault-access commands, admin-role changes, Jump Item sessions, file transfers and downstream endpoint telemetry is stronger than isolated perimeter IOCs for detecting this intrusion class.
Measured SOC/IR performance, false-positive baselines and independent appliance telemetry.
UNC6671/BlackFile, PREY-0058, Microsoft Storm labels and The-Com-linked operators cannot be safely merged from shared vishing/AiTM/SaaS-exfiltration tradecraft.
Shared victim/time/infrastructure/operator artifacts or authoritative alias mapping.
No representative denominator or controlled multi-environment dataset quantifies prevalence or comparative effectiveness of phishing-resistant MFA/device-bound passkeys, managed-device CA, device-code restrictions and strict security-info registration.
Representative tenant/sector denominator plus normalized control deployment and before/after outcomes.