Passkey-themed phishing attacks lead to Microsoft 365 data theft

Microsoft has warned that extortion-focused groups, including those tied to ShinyHunters and Helix, are running social engineering campaigns that pose as passkey and single sign-on prompts. The goal is to take over corporate Microsoft accounts and extract data stored in Microsoft 365 services, which is then typically used for extortion.