News › security
By Zayden R., September 13, 2026
Microsoft reports two phishing campaigns using passkey themes and CEO impersonation to hijack cloud accounts and exfiltrate data. Over a million scam emails were sent, targeting U.S. enterprise users in various sectors.
Microsoft has unveiled details of two sophisticated phishing campaigns that have successfully compromised cloud accounts by exploiting passkey themes and executive impersonation. This matters because it highlights evolving threats that cloud administrators and IT security teams must vigilantly guard against.
In the first campaign, over a million fraudulent emails were blasted between August 3 and 5, 2026. These emails masqueraded as communications from CEOs of targeted companies, aiming to trick accounts payable departments into initiating Automated Clearing House (ACH) transfers for a fictitious ServiceNow subscription. The attackers crafted these emails using generative AI, tailoring them to appear convincing to finance personnel. The campaign specifically targeted enterprise users in the U.S., spanning sectors like IT services, consumer goods, real estate, and manufacturing.
What sets this campaign apart is its layered approach. Unlike typical invoice scams that rely on a single lure, this operation incorporated executive impersonation, vendor branding, and fabricated email threads to create a more convincing narrative. By using bogus domains that mimic trusted brands, such as service-nowinc[.]com, the attackers added a layer of legitimacy to their deception.
In parallel, a second campaign leveraged passkey-themed social engineering tactics to breach cloud environments. This method highlights the growing trend of attackers moving beyond traditional phishing techniques to exploit newer security mechanisms. For engineers, this underscores the importance of implementing multi-layered security strategies that include user education, regular audits of domain registrations, and vigilant monitoring of email delivery infrastructures.
These campaigns serve as a stark reminder of the innovative lengths to which threat actors will go to breach systems and exfiltrate data. As the digital threat landscape continues to evolve, so too must the defenses of those responsible for safeguarding sensitive corporate and personal information.