September 2026 retrospective · Added November 13, 2026.
Microsoft’s September 9, 2026 research described cloud intrusions that began with identity-focused social engineering and were followed by unauthorized authentication changes and access to business data. In some cases, attackers used a supposed passkey or single-sign-on update as the pretext for a fake helpdesk interaction.
The security story was part of the lure
The research did not show that passkeys themselves had been broken. It described attackers using familiar security language to guide people into phishing or device-code authorization flows. That distinction matters: a message about improving security can itself be the attack.
Make legitimate support recognizable
Our recommendation is to establish a known channel for verifying unexpected IT requests. Employees should be able to pause a call, contact support through a trusted number or portal, and confirm the request without being pressured to continue.
Do not approve an unexpected sign-in or enter an authorization code simply because a caller claims to be IT.
Report unsolicited requests to change authentication methods.
Give the helpdesk a documented identity-verification process.
Include personal-phone calls and text messages in awareness training.
Investigate beyond the first sign-in
Microsoft emphasized connecting signals across identity and cloud services. A business response should consider whether an attacker added an authentication method, retained a session, or accessed files and mail—not only whether a password was reset.
For business leaders, the practical question is who watches for those changes and who acts on them. Identity threat detection and response adds a different layer of visibility from endpoint protection alone.
Explore Proper Access Cybersecurity.
