Microsoft Security Research reported active campaigns in 2026 in which attackers used passkey, multifactor authentication and single sign-on themes as social-engineering bait.
The important detail is that the attacker was not necessarily trying to steal a passkey itself.
Instead, the lure could lead a victim into adversary-in-the-middle phishing or device-code authentication flows, giving the attacker access to a cloud identity.
This is a useful warning because security terminology can create false confidence. A message mentioning passkeys or MFA is not automatically a security message.
Attackers know that people recognise words such as “MFA”, “passkey” and “security verification”. They can use those words to make a malicious request sound responsible.
The safest response is to treat unsolicited authentication instructions with suspicion.
If someone unexpectedly contacts you and says your authentication needs to be updated, do not use the link or code they provide. Open the legitimate service yourself or contact your organisation's verified support channel.
The lesson is simple: security technology protects you only when the authentication request itself is legitimate.