{"id":10723,"date":"2026-09-14T16:25:26","date_gmt":"2026-09-14T20:25:26","guid":{"rendered":"https:\/\/hostingdiscussion.com\/news\/?p=10723"},"modified":"2026-09-14T13:39:15","modified_gmt":"2026-09-14T17:39:15","slug":"hackers-are-using-the-word-passkey-to-break-into-cloud-accounts","status":"publish","type":"post","link":"https:\/\/hostingdiscussion.com\/news\/hackers-are-using-the-word-passkey-to-break-into-cloud-accounts\/","title":{"rendered":"Hackers are using the word &#8220;passkey&#8221; to break into cloud accounts"},"content":{"rendered":"<p dir=\"ltr\"><a href=\"https:\/\/www.microsoft.com\/en-us\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Microsoft<\/a> has laid out a pair of campaigns that share an unsettling theme: attackers are borrowing the language of security itself to get past it.<\/p>\n<p dir=\"ltr\">The first campaign sent more than a million scam emails over just three days in early August, each one posing as a company CEO asking accounts payable to wire money for a fake <a href=\"https:\/\/hostingdiscussion.com\/news\/servicenow-locks-in-1-2b-google-cloud-deal-as-multi-platform-strategy-expands\/\">ServiceNow<\/a> subscription. Researchers say the attackers likely used generative AI to draft the emails, and they did not run the usual clumsy phishing playbook. The messages carried forged invoices, fabricated email threads, and real executive names the attackers pulled from public sources, and they wove all of it together so the request looked routine rather than suspicious. The group even registered domains like service-nowinc[.]com just to sell the illusion.<\/p>\n<p dir=\"ltr\">The second campaign gets more interesting, and more troubling for anyone managing cloud infrastructure. Instead of stealing passwords outright, attackers have been calling or texting employees on their personal phones, claiming to be IT help desk staff, and telling them their passkey or MFA setup needs an urgent update.<\/p>\n<p dir=\"ltr\">The link leads to a fake Microsoft sign-in page. From there, the attacker either grabs the credentials directly or talks the employee through a device-code flow that hands over account access without ever touching a password.<\/p>\n<p dir=\"ltr\">Once inside, the pattern looks less like a smash and grab and more like a patient occupation. Microsoft says <a href=\"https:\/\/hostingdiscussion.com\/news\/ai-is-shrinking-how-fast-hackers-exploit-new-cloud-vulnerabilities\/\">attackers<\/a> typically register their own MFA method first, often a new phone number or authenticator app, so they can keep signing in even after someone notices the original compromise. From there they run reconnaissance through the Graph API, harvest mailboxes, and pull bulk downloads from <a href=\"https:\/\/hostingdiscussion.com\/news\/sharepoint-servers-under-siege-as-zero-day-exploit-bypasses-mfa-protections\/\">SharePoint<\/a> and OneDrive that can stretch on for days.<\/p>\n<p dir=\"ltr\">Microsoft has tied parts of this activity to groups it calls Storm-3121 and Storm-3032, and Mandiant has traced overlaps to a loosely connected set of extortion brands that share phishing infrastructure. The detail worth sitting with is simpler than any group name: attackers have turned the feature meant to make cloud accounts harder to break into into the pretext they use to break into them.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Microsoft has laid out a pair of campaigns that share an unsettling theme: attackers are borrowing the language of security itself to get past it. The first campaign sent more than a million scam emails over just three days in early August, each one posing as a company CEO asking accounts payable to wire money [&hellip;]<\/p>\n","protected":false},"author":20624,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[71],"tags":[8085,8086,8084,8082,8083],"class_list":["post-10723","post","type-post","status-publish","format-standard","hentry","category-featured","tag-business-email-compromise","tag-cloud-account-takeover","tag-mfa-bypass-attack","tag-microsoft-cloud-security","tag-passkey-phishing"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.2 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Hackers are using the word &quot;passkey&quot; to break into cloud accounts - Web Hosting News<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hostingdiscussion.com\/news\/hackers-are-using-the-word-passkey-to-break-into-cloud-accounts\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Hackers are using the word &quot;passkey&quot; to break into cloud accounts - Web Hosting News\" \/>\n<meta property=\"og:description\" content=\"Microsoft has laid out a pair of campaigns that share an unsettling theme: attackers are borrowing the language of security itself to get past it. The first campaign sent more than a million scam emails over just three days in early August, each one posing as a company CEO asking accounts payable to wire money [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hostingdiscussion.com\/news\/hackers-are-using-the-word-passkey-to-break-into-cloud-accounts\/\" \/>\n<meta property=\"og:site_name\" content=\"Web Hosting News\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-14T20:25:26+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-14T17:39:15+00:00\" \/>\n<meta name=\"author\" content=\"Justine Juyad\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Justine Juyad\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/hackers-are-using-the-word-passkey-to-break-into-cloud-accounts\/\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/hackers-are-using-the-word-passkey-to-break-into-cloud-accounts\/\",\"name\":\"Hackers are using the word \\\"passkey\\\" to break into cloud accounts - Web Hosting News\",\"isPartOf\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\"},\"datePublished\":\"2026-09-14T20:25:26+00:00\",\"dateModified\":\"2026-09-14T17:39:15+00:00\",\"author\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\"},\"breadcrumb\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/hackers-are-using-the-word-passkey-to-break-into-cloud-accounts\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/hostingdiscussion.com\/news\/hackers-are-using-the-word-passkey-to-break-into-cloud-accounts\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/hackers-are-using-the-word-passkey-to-break-into-cloud-accounts\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/hostingdiscussion.com\/news\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Hackers are using the word &#8220;passkey&#8221; to break into cloud accounts\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/\",\"name\":\"Web Hosting News\",\"description\":\"Cloud and web hosting industry daily news\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\",\"name\":\"Justine Juyad\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"caption\":\"Justine Juyad\"},\"description\":\"HostingDiscussion.com senior reporter\",\"sameAs\":[\"https:\/\/hostingdiscussion.com\/news\/\"],\"url\":\"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Hackers are using the word \"passkey\" to break into cloud accounts - Web Hosting News","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hostingdiscussion.com\/news\/hackers-are-using-the-word-passkey-to-break-into-cloud-accounts\/","og_locale":"en_US","og_type":"article","og_title":"Hackers are using the word \"passkey\" to break into cloud accounts - Web Hosting News","og_description":"Microsoft has laid out a pair of campaigns that share an unsettling theme: attackers are borrowing the language of security itself to get past it. The first campaign sent more than a million scam emails over just three days in early August, each one posing as a company CEO asking accounts payable to wire money [&hellip;]","og_url":"https:\/\/hostingdiscussion.com\/news\/hackers-are-using-the-word-passkey-to-break-into-cloud-accounts\/","og_site_name":"Web Hosting News","article_published_time":"2026-09-14T20:25:26+00:00","article_modified_time":"2026-09-14T17:39:15+00:00","author":"Justine Juyad","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Justine Juyad","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/hostingdiscussion.com\/news\/hackers-are-using-the-word-passkey-to-break-into-cloud-accounts\/","url":"https:\/\/hostingdiscussion.com\/news\/hackers-are-using-the-word-passkey-to-break-into-cloud-accounts\/","name":"Hackers are using the word \"passkey\" to break into cloud accounts - Web Hosting News","isPartOf":{"@id":"https:\/\/hostingdiscussion.com\/news\/#website"},"datePublished":"2026-09-14T20:25:26+00:00","dateModified":"2026-09-14T17:39:15+00:00","author":{"@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3"},"breadcrumb":{"@id":"https:\/\/hostingdiscussion.com\/news\/hackers-are-using-the-word-passkey-to-break-into-cloud-accounts\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hostingdiscussion.com\/news\/hackers-are-using-the-word-passkey-to-break-into-cloud-accounts\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/hostingdiscussion.com\/news\/hackers-are-using-the-word-passkey-to-break-into-cloud-accounts\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/hostingdiscussion.com\/news\/"},{"@type":"ListItem","position":2,"name":"Hackers are using the word &#8220;passkey&#8221; to break into cloud accounts"}]},{"@type":"WebSite","@id":"https:\/\/hostingdiscussion.com\/news\/#website","url":"https:\/\/hostingdiscussion.com\/news\/","name":"Web Hosting News","description":"Cloud and web hosting industry daily news","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3","name":"Justine Juyad","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","caption":"Justine Juyad"},"description":"HostingDiscussion.com senior reporter","sameAs":["https:\/\/hostingdiscussion.com\/news\/"],"url":"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/"}]}},"views":74,"_links":{"self":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10723","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/users\/20624"}],"replies":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/comments?post=10723"}],"version-history":[{"count":1,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10723\/revisions"}],"predecessor-version":[{"id":10724,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10723\/revisions\/10724"}],"wp:attachment":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/media?parent=10723"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/categories?post=10723"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/tags?post=10723"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}