The Passkey Paradox: When Your Security Upgrade Becomes the Attack Surface

If your CISO walked into the next board meeting and said, "We're deploying passkeys to eliminate phishing," most directors would nod approvingly. Passkeys are the industry's consensus answer to credential theft — phishing-resistant, passwordless, backed by every major platform vendor. It sounds like progress.

Here's the problem: attackers just turned that progress into a weapon.

On September 9, Microsoft Security Research published a detailed advisory describing an active campaign in which multiple threat actor groups — including clusters linked to the ShinyHunters and Helix extortion operations — are using passkey enrollment as the social engineering lure to compromise enterprise cloud accounts. The activity has been observed across multiple organizations since May 2026, and it exploits something no technology can patch: human trust in the upgrade process itself.

How the Attack Works

The playbook is deceptively simple. An employee receives a call or text on their personal phone from someone claiming to be the IT helpdesk. The caller creates urgency: a passkey or MFA configuration must be updated immediately to avoid disruption. The employee is directed to a website that closely resembles a legitimate Microsoft sign-in page — often using domains like company-name.secure-passkey[.]com or company-name.add-passkey[.]com.

Despite the passkey-themed lure, passkey enrollment is rarely the attacker's true objective. The narrative is a convincing pretext to guide victims through adversary-in-the-middle (AiTM) phishing or device-code authentication flows. In AiTM scenarios, the attacker captures credentials and session tokens. In device-code attacks, the victim unknowingly authorizes access on the attacker's behalf.

What happens next is where the real damage begins. Once inside, the attacker's first move is to register a new MFA method — a phone number, authenticator app, or software-based OTP token — under their own control. This transforms a temporary compromise into a persistent foothold. The attacker now has their own key to the front door.

From there, Microsoft observed automated reconnaissance using Microsoft Graph to inventory users, groups, permissions, and accessible content across the entire tenant. Then comes the data collection: high-volume access to SharePoint, OneDrive, and Exchange, often spanning hours to days at a pace calibrated to blend with normal enterprise usage — fewer than 1,000 files per hour.

Why This Matters to the Board

This attack pattern reveals a governance blind spot that most organizations haven't considered: every security upgrade creates a transition period of increased risk.

When your organization announces a passkey rollout, you've just told every employee to expect calls from IT about changing their authentication. You've primed them to comply. Attackers know this, and they're moving faster than your rollout timeline.

This is a textbook example of what I call the "compliance-versus-security" gap in Cyber Risk Is Business Risk. Deploying passkeys checks an important compliance box. But without controlled enrollment processes — managed devices, verified channels, strict conditional access policies around authentication method registration — you've created a new attack surface while congratulating yourself on closing the old one.

The Three Questions Your Board Should Ask

In the book, I outline the Three Questions framework that every board should use when evaluating cyber risk. Applied to this situation:

1. What's our exposure? If your employees can register new authentication methods from unmanaged devices without additional verification, you're exposed. Microsoft's advisory specifically notes that when victims open phishing links on personal mobile phones not onboarded to endpoint detection, "the related activity may be absent from endpoint telemetry." The attack leaves almost no forensic evidence at the point of entry.

2. Are we keeping up? Multiple threat actor groups are already running this playbook. Microsoft identified clusters linked to ShinyHunters (known for data extortion), Helix (a splinter group from BlackFile), and additional operators in the same ecosystem. This is not a theoretical attack — it is an active, multi-actor campaign.

3. What's the plan? Microsoft's own mitigation guidance reads like a checklist your CISO should be able to answer today: Are authentication method registrations restricted to managed devices? Is device-code authentication blocked where not explicitly needed? Are Graph API activity logs enabled and monitored for anomalous enumeration? Is there a verified channel for employees to confirm helpdesk requests?

What to Ask Your CISO This Week

The irony of the passkey paradox is that passkeys remain the right destination. The vulnerability is in the journey. Here's what directors should be asking:

"How are we controlling authentication method enrollment?" The critical control is not whether you deploy passkeys — it's whether an attacker can register their own authentication method after a compromise. Microsoft recommends enforcing strict conditional access controls for security info registration, including requiring managed devices, named locations, and phishing-resistant MFA.

"Do our employees know how to verify a legitimate passkey enrollment request?" If the answer involves "they'd call the helpdesk," ask how the helpdesk verifies identity. Microsoft's advisory notes that some attackers are even using compromised internal accounts to send passkey-themed messages through Microsoft Teams, making the request appear to come from a trusted colleague.

"What does our post-compromise detection look like for identity attacks?" The attackers in this campaign operated for hours to days inside compromised tenants. If your security operations center isn't correlating unusual sign-ins with new MFA registrations, Graph API reconnaissance, and abnormal file access patterns, an attacker following this exact playbook could be inside your environment right now and you wouldn't know it.

The Bigger Lesson

Every security investment has an operational dimension that the board needs to understand. Passkeys don't fail here — process fails here. The technology is sound. But technology deployed without process controls, employee training, and detection capabilities is just expensive theater.

As I write in Cyber Risk Is Business Risk, the board's job isn't to understand the cryptographic properties of passkeys. It's to ask whether the organization has thought through the transition risks, whether the security team can detect when the upgrade itself becomes the attack vector, and whether there's a plan for the gap between announcement and full deployment.

The attackers in this campaign understood that gap perfectly. The question is whether your board does too.