Listen to the episode
TLDR
Cybercriminals are cold calling or texting employees on their personal phones, pretending to be the internal IT helpdesk. They claim a passkey, MFA, or SSO setup must be updated right away to avoid disruption, then walk the victim through...
How it works
Cybercriminals are cold calling or texting employees on their personal phones, pretending to be the internal IT helpdesk. They claim a passkey, MFA, or SSO setup must be updated right away to avoid disruption, then walk the victim through...
Red flags
- An unsolicited call or SMS from "IT" pressuring you to update a passkey or MFA right now . A sign in link arriving on your personal phone via SMS or Teams from a coworker who never mentioned anything offline. Being asked to approve a device code prompt or paste a code you didn't request this grants the attacker your session
What to do
- 1Hang up and call your IT desk on the number listed in the corporate directory
- 2never use the number the caller gives you. Never enter credentials or approve a code on a site you didn't navigate to yourself. Report the call immediately to
Source
microsoft-security
Source reviewed by Mythos Forensic Team
https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/FAQ
Is Passkey helpdesk scam: fake IT calls lead to cloud account takeover a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
An unsolicited call or SMS from "IT" pressuring you to update a passkey or MFA right now . A sign in link arriving on your personal phone via SMS or Teams from a coworker who never mentioned anything offline. Being asked to approve a device code prompt or paste a code you didn't request this grants the attacker your session
What should I do first?
Hang up and call your IT desk on the number listed in the corporate directory; never use the number the caller gives you. Never enter credentials or approve a code on a site you didn't navigate to yourself. Report the call immediately to
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.