Fake IT Helpdesk Calls Are Hijacking Business Email Accounts — Passkey Lures

Attackers are not breaking cloud email with a clever zero-day. They are calling or texting employees, pretending to be the IT helpdesk, and walking them into a fake “passkey” or MFA update. A major cloud provider’s threat research team says this pattern has been active since May 2026 — and it ends with attacker-controlled MFA, directory reconnaissance, and file and mail theft.

What’s new

A September 9, 2026 threat-research post from one of the largest cloud email and office-suite providers tracks passkey-, MFA-, and single-sign-on-themed social engineering that leads to identity and cloud compromise. The opener is usually a phone call or text to a personal number: “Your passkey/MFA/SSO must be updated now or access will break.” Victims land on lookalike sign-in pages. Despite the passkey story, the real goal is often adversary-in-the-middle (AiTM) phishing or device-code flows that capture sessions — then the attacker registers their own MFA method so they can come back. After that comes reconnaissance of users and shared sites, and high-volume access to shared files, cloud drives, and mailboxes.

In some cases, compromised accounts are reused to push the same lure over the company’s internal chat app, which raises click-through because the message looks internal.

Why San Antonio SMBs should care

South Texas medical, finance, professional, and multi-site firms run on cloud email and shared files. One successful helpdesk impersonation can expose patient or client files, shared drives, and mailbox history — without an alert on the company laptop if the employee opened the link on a personal phone.

Remote-managed SMBs nationwide face the same identity risk: if MFA enrollment and device-code flows are wide open, a convincing “IT called me” story is enough.

Practical next steps (this week)

1. Train the helpdesk test — Real IT will never cold-call or text a personal phone asking you to enroll a passkey or MFA via a link. Hang up, call your known IT number, and verify before clicking anything.
2. Lock MFA registration — Use conditional access rules so adding a new sign-in method requires phishing-resistant MFA, a managed device and/or a known location, and blocks high-risk sign-ins from adding methods.
3. Prefer phishing-resistant MFA — Push hardware keys or passkeys for admins and high-value users; treat SMS or voice codes as temporary only.
4. Block device-code sign-in (unless you have a documented need) — Device-code phishing is a common follow-on after the passkey lure.
5. Hunt for unauthorized MFA and unusual activity — Alert on new authenticator or phone methods after unusual sign-ins, mass lookups of users and shared sites, and bursts of file downloads or mailbox access. On confirmation: revoke sessions, reset credentials, remove attacker MFA methods, and re-enroll properly.

For South Texas teams on-site: walk the floor (or the team chat) this week — confirm nobody “updated MFA for IT” after an unexpected call, and verify guest Wi-Fi and building systems stay segmented from the office network. For remote-managed clients nationwide: ask your IT provider for a one-page check — MFA registration policy, device-code status, and the last 7 days of sign-in method changes.

Nice2GeekYou supports San Antonio on-site work (fiber, Cat6, racks) and remote managed IT clients across the U.S. with the same foundation: identity hygiene first, then the wiring and day-to-day IT that keep the business running. Request a quote.

Source: The provider’s threat-research post on passkey-themed social engineering (Sept. 9, 2026)