Kurzfassung
Cybercriminals are cold calling or texting employees on their personal phones, pretending to be the internal IT helpdesk. They claim a passkey, MFA, or SSO setup must be updated right away to avoid disruption, then walk the victim through...
Wie es funktioniert
Cybercriminals are cold calling or texting employees on their personal phones, pretending to be the internal IT helpdesk. They claim a passkey, MFA, or SSO setup must be updated right away to avoid disruption, then walk the victim through...
Warnzeichen
- An unsolicited call or SMS from "IT" pressuring you to update a passkey or MFA right now . A sign in link arriving on your personal phone via SMS or Teams from a coworker who never mentioned anything offline. Being asked to approve a device code prompt or paste a code you didn't request this grants the attacker your session
Was tun
- 1Hang up and call your IT desk on the number listed in the corporate directory
- 2never use the number the caller gives you. Never enter credentials or approve a code on a site you didn't navigate to yourself. Report the call immediately to
Quelle
microsoft-security
Quelle geprueft vom Mythos Forensic Team
https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/FAQ
Ist Passkey helpdesk scam: fake IT calls lead to cloud account takeover ein reales Betrugsmuster?
Ja. Behandeln Sie Nachricht, Anruf oder Zahlungsaufforderung als verdaechtig, bis ein offizieller Kanal sie bestaetigt.
Was sind die ersten Warnzeichen?
An unsolicited call or SMS from "IT" pressuring you to update a passkey or MFA right now . A sign in link arriving on your personal phone via SMS or Teams from a coworker who never mentioned anything offline. Being asked to approve a device code prompt or paste a code you didn't request this grants the attacker your session
Was sollte ich zuerst tun?
Hang up and call your IT desk on the number listed in the corporate directory; never use the number the caller gives you. Never enter credentials or approve a code on a site you didn't navigate to yourself. Report the call immediately to
Kann LegalAudit meinen Fall pruefen?
Ja. Starten Sie den kostenlosen Chat und fuegen Sie Nachricht, Link, Absender oder Zahlungsdaten ein.