Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data

Microsoft has disclosed details of two campaigns in which threat actors are abusing third-party email delivery infrastructure to blast financial fraud scam messages and using passkey-themed social engineering to breach cloud environments. The first campaign, per the tech giant, involved sending over a million scam emails between August 3 and 5, 2026, by masquerading as chief executive officers

Report facts: Microsoft disclosed two campaigns where threat actors abused third‑party email infrastructure to send over a million CEO‑impersonation scam emails and used passkey‑themed social engineering to compromise Microsoft cloud accounts and exfiltrate data. These attacks target identity and access mechanisms in cloud SaaS environments rather than the AI models themselves. RealGround analysis: For organizations embedding AI agents into Microsoft or other cloud SaaS platforms, similar account‑takeover and phishing techniques can be used to hijack AI integrations, pivot through agent permissions, and access sensitive data flows. Hardening cloud identity (MFA/passkeys), isolating AI agents with least‑privilege access, and monitoring for anomalous agent activity are critical to prevent AI‑enabled business process abuse when SaaS accounts are compromised.