In September 2026, Microsoft disclosed campaigns using passkey-themed social engineering to breach cloud environments, alongside a wave of scam emails. The lesson is important: even strong authentication like passkeys can be undermined by tricking people, so awareness and layered defences matter as much as the technology itself.
What happened
In September 2026, Microsoft disclosed details of active campaigns in which attackers were breaching cloud environments using passkey-themed social engineering, and separately blasting large volumes of financial fraud scam emails through third-party email infrastructure. One campaign reportedly sent over a million scam messages in a matter of days, impersonating senior executives.
The passkey angle is the one worth dwelling on. Passkeys are widely, and rightly, promoted as a stronger, phishing-resistant form of authentication. So a campaign that uses passkey-themed social engineering to breach cloud accounts is a notable development. It is a reminder that attackers adapt to new defences, and that even strong technology can be undermined when the target is a person rather than the technology itself.
What passkeys are and why they matter
Passkeys are a modern authentication method designed to replace passwords with something more secure. Instead of a password that can be phished, guessed or reused, a passkey uses cryptographic keys tied to your device, and it is designed to resist the phishing that defeats passwords. For this reason, passkeys are considered one of the stronger forms of authentication available, and their adoption is encouraged.
That is what makes attacks in this space significant. Passkeys are supposed to be resistant to phishing, so campaigns that find ways to social-engineer their way around passkey protections show that attackers are working hard to undermine even the defences meant to stop them. It does not mean passkeys are ineffective, they remain strong, but it does mean the human element around them still matters.
Why attackers target the person, not the technology
The consistent lesson across these campaigns is that attackers go after people. When a technology like passkeys makes direct attacks harder, attackers shift to social engineering, tricking the person into taking an action that undermines the protection. That might mean manipulating a user during a passkey setup or recovery process, or deceiving them into approving something they should not.
This is the enduring reality of security: technology can be made very strong, but people can still be deceived. Attackers understand this, which is why so many campaigns, including these, centre on manipulating human beings rather than defeating the technology head-on. The strongest authentication in the world does not help if a person can be tricked into working around it.
The scam email dimension
Alongside the passkey campaign, the disclosed activity included sending over a million scam emails by abusing third-party email delivery infrastructure and impersonating executives. This is a reminder of the scale and persistence of email-based fraud, and of business email compromise, where attackers impersonate senior people to defraud organisations.
The two campaigns together, sophisticated social engineering against strong authentication, and mass fraud through impersonation, illustrate the range of ways attackers target organisations through their people and their trust. Both bypass technical defences by exploiting human judgement, which is why defending the human layer is so important.
What this means for your business
The practical takeaways for an organisation are clear. First, adopt strong authentication like passkeys and multi-factor authentication, because they genuinely raise the bar, this is not an argument against them. Second, recognise that strong authentication is not a complete defence on its own, because attackers will try to social-engineer around it, so awareness and layered defences remain essential.
That means training people to recognise social engineering, including the newer forms that target authentication processes, and being alert to executive impersonation and fraud. It means having layered defences, so a single deceived person does not lead to a full compromise. And it means monitoring for the signs of compromise, so an account takeover that gets through is caught quickly. Technology and people together, not technology alone, are what keep an organisation secure.
Defending against these attacks
Concretely, defending against passkey-themed social engineering and executive-impersonation fraud comes down to a familiar combination. Deploy strong authentication and configure it carefully. Train staff to recognise social engineering and to be sceptical of unexpected requests, especially those invoking authority or urgency. Verify high-risk requests, such as payments or authentication changes, through a separate channel. And monitor cloud environments for signs of unauthorised access, so a breach is detected early.
If you want help strengthening your defences against social engineering and account takeover, or detecting compromise in your cloud environment, see our managed detection and response services, or talk to us about building a security programme through our virtual CISO services.
For the details of the disclosed campaigns, confirm against Microsoft’s advisory and reputable reporting.
Frequently asked questions
What is passkey phishing?
It refers to social engineering that targets passkey authentication, tricking people into taking actions that undermine passkey protections, rather than defeating the technology directly. Microsoft disclosed campaigns using passkey-themed social engineering to breach cloud environments in September 2026.
Does this mean passkeys are not secure?
No. Passkeys remain a strong, phishing-resistant form of authentication and should be adopted. What these campaigns show is that attackers try to social-engineer around even strong defences by targeting people, so awareness and layered defences remain essential alongside the technology.
Why do attackers target people instead of technology?
Because technology can be made very strong, but people can still be deceived. When a defence like passkeys makes direct attacks harder, attackers shift to manipulating the person into undermining it, which is often easier than defeating the technology head-on.
How do you defend against these attacks?
Adopt strong authentication, train staff to recognise social engineering and unexpected requests, verify high-risk requests like payments or authentication changes through a separate channel, and monitor cloud environments for signs of unauthorised access so a breach is caught early.
