Passkey-themed social engineering leads to identity and cloud compromise

Threat actors are leveraging convincing passkey-themed social engineering to compromise cloud identities, establish persistent access via malicious MFA enrollment, and systematically exfiltrate sensitive data from Microsoft 365 environments using automated reconnaissance and collection techniques.