Passkey-themed phishing drains corporate Microsoft 365 accounts

Microsoft documents attacks in which ShinyHunters and Helix-linked gangs impersonate the help desk to steer employees toward passkey-themed phishing pages, then exfiltrate Microsoft 365 data. The defense rests less on the passkey itself than on phishing-resistant authentication and session revocation.