A caller says they are from IT. They know your company’s name, sound professional, and warn that your Microsoft 365 passkey or multifactor authentication must be updated immediately.
It feels like routine technical support. That is exactly why the scam works.
Microsoft recently reported an active campaign in which attackers use passkey, single sign-on, and multifactor authentication updates as a pretext. The objective is not necessarily to steal a passkey. Instead, the attacker persuades an employee to complete a sign-in process that gives the criminal access to the employee’s cloud account.
For a small business, one successful conversation can expose email, OneDrive files, SharePoint documents, customer information, and internal communications.
The attack often begins with an unsolicited phone call, text message, email, or Microsoft Teams message. The person claims to represent the company’s IT department or technology provider.
They may say:
The employee may then receive a link to a convincing sign-in page. In some cases, the attacker asks the employee to enter a device code on a genuine Microsoft webpage. Although the page itself is real, entering the code can authorize the attacker’s session.
That distinction matters: seeing a familiar Microsoft page does not automatically mean the request is legitimate.
Passkeys remain a strong sign-in method. They are designed to resist ordinary password phishing and are generally safer than reusable passwords or text-message codes.
The danger is the surrounding conversation.
Criminals are taking advantage of the fact that many employees are still learning what passkeys are. A technical-sounding caller can turn that uncertainty into urgency and persuade someone to follow an unauthorized enrollment or approval process.
Microsoft’s report also notes that some attackers add their own authentication method after gaining access. This can help them return even after the employee changes a password.
A Microsoft 365 account can contain far more than email. Depending on the employee’s access, a criminal may be able to:
Microsoft observed compromised identities being used to examine cloud resources and collect business data over time. This means an incident may not produce an immediate, obvious warning.
Employees should never complete an unexpected authentication change while communicating with the person who initiated the request.
Instead:
Even if the message appears to come from a coworker’s Teams or email account, verify unusual authentication requests through a separate channel. A trusted account may already have been compromised.
Employees should know exactly how real IT requests will arrive and how to confirm them. Provide one official support number or portal and include the procedure in new-employee onboarding.
A device code can authorize access without revealing a password. Employees should never enter a code that was supplied by an unsolicited caller or message.
An administrator or managed IT provider should periodically check which phones, authenticator apps, passkeys, and security keys are registered to important accounts. An unfamiliar method should be investigated promptly.
Microsoft recommends phishing-resistant sign-in methods such as properly deployed passkeys, FIDO2 security keys, and Windows Hello for Business. Organizations can also restrict authentication registration, block unnecessary device-code flows, and require managed devices for sensitive services.
These settings should be planned and tested by someone familiar with Microsoft 365 administration. Changing access policies without preparation can lock legitimate employees out of their accounts.
Warning signs can include unexpected authentication registrations, unfamiliar sign-ins, newly created mailbox rules, unusual file downloads, and access from unmanaged devices.
Contact your IT or cybersecurity provider immediately. Do not wait for suspicious email activity to appear.
A qualified administrator may need to revoke active sessions, reset credentials, remove unauthorized authentication methods, examine mailbox rules, and review activity across Exchange, OneDrive, SharePoint, and Microsoft 365.
Changing the password alone may not terminate an already authorized session or remove an authentication method added by the attacker.
Employees are more likely to resist social engineering when they have a quick, familiar way to verify requests. The goal is not to make staff afraid of every technology change. It is to make stopping and checking a normal part of the process.
Trustindex verifies that the original source of the review is Google. 
Trustindex verifies that the original source of the review is Google. 
Trustindex verifies that the original source of the review is Google. 
Trustindex verifies that the original source of the review is Google. 
Trustindex verifies that the original source of the review is Google. 
Trustindex verifies that the original source of the review is Google. 
Trustindex verifies that the original source of the review is Google. 
Trustindex verifies that the original source of the review is Google. 
Trustindex verifies that the original source of the review is Google. 
Trustindex verifies that the original source of the review is Google. 
Himala and his team at Cybernetic Networks have been amazing. We have been a customer of Cybernetic Networks for well over 14 years now, both personally and professionally. Himala and his team are professional, reachable and on the cutting edge of technology. We have enjoyed doing business with Cybernetic Networks for many years and still rely on their knowledge, skills and technology every day
Himala and his Cybernetic team have never let me down! For over 10 years now they have been fixing my technical issues, set up all my new networks and computers and have safeguarded me from any hackers or malware. You can trust this company to navigate you as your company grows and to keep you on track with the latest in security and safety
I am a solo practicing neurologist and have had all my IT needs covered through Cybernetic Networks since 2007. They are the best! All of their tech support staff is extremely knowledgeable and efficient. Just as importantly, they are quickly responsive whenever we need their assistance. I couldn’t be happier with their service and give them my highest recommendation!
I couldn't be happier with Cybernetics - they are experts, always respond quickly , and solves any issues I have.
Cybernetic Networks has been advising and supporting all our IT issues and purchases for the last 18 years. They are very responsive and extremely knowledgeable- always providing us with timely services.
It is not often you find small business companies that are not only rewarding to work with, but also have integrity, truth and skill. I have worked with this company for over 20 years, and the service is outstanding. I can easily recommend that if you need an IT company, this is the one to get. Full STOP! Look no further, you will be happy that you did. Sue Myhelic, Gulf Breeze Real Estate, Naples, Florida.
Himala and his team from Cybernetic Networks, Inc. has been an integral part of our successful retail business for the past 20 years. He is extraordinarily knowledgable and always available for our IT needs. Thanks to Himala and his team we are always up and running.
