{
  "id": 7353251,
  "title": "Microsoft Cloud accounts stolen in highly complex impersonation and passkey phishing campaign",
  "url": "https://urgent.news/2026/09/14/microsoft-cloud-accounts-stolen-in-highly-complex-impersonation-and",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-14T16:10:00.000Z",
  "source": {
    "name": "TechRadar",
    "slug": "techradar",
    "url": "https://www.techradar.com/pro/security/microsoft-cloud-accounts-stolen-in-highly-complex-impersonation-and-passkey-phishing-campaign"
  },
  "original_language": "en",
  "account": "Microsoft has issued an alert regarding a complex cyber attack targeting cloud accounts. The attack involves a sophisticated impersonation and passkey phishing scheme. Victims are called by what appears to be their organization's IT help desk, instructed to update their passkey or MFA immediately to prevent operational disruptions. After the phone call, victims receive an SMS with a link leading to a fake Microsoft login page, a result of adversary-in-the-middle techniques. This site is used to either grant the attacker access or steal credentials. The attackers invest significantly in research, using public information from social networking and professional platforms to gather data about employees and organizational structures. In some instances, compromised accounts are exploited to spread similar passkey-themed messages through Microsoft Teams. The campaign has been ongoing since at least May of this year, targeting the exfiltration of files from SharePoint, OneDrive, and email data from Microsoft Exchange Online.",
  "summary": "Passkeys have all but eliminated password theft, so what now? Criminals have a solution.",
  "key_points": [
    "Sophisticated impersonation and passkey phishing scheme targets Microsoft Cloud accounts.",
    "Attackers use adversary-in-the-middle techniques to steal credentials via fake Microsoft login page."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}