Ascolta l'episodio
In breve
Cybercriminals are cold calling or texting employees on their personal phones, pretending to be the internal IT helpdesk. They claim a passkey, MFA, or SSO setup must be updated right away to avoid disruption, then walk the victim through...
Come funziona
Cybercriminals are cold calling or texting employees on their personal phones, pretending to be the internal IT helpdesk. They claim a passkey, MFA, or SSO setup must be updated right away to avoid disruption, then walk the victim through...
Indicatori rossi
- An unsolicited call or SMS from "IT" pressuring you to update a passkey or MFA right now . A sign in link arriving on your personal phone via SMS or Teams from a coworker who never mentioned anything offline. Being asked to approve a device code prompt or paste a code you didn't request this grants the attacker your session
Cosa fare
- 1Hang up and call your IT desk on the number listed in the corporate directory
- 2never use the number the caller gives you. Never enter credentials or approve a code on a site you didn't navigate to yourself. Report the call immediately to
Fonte
microsoft-security
Fonte verificata da Mythos Forensic Team
https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/FAQ
Passkey helpdesk scam: fake IT calls lead to cloud account takeover e una truffa reale?
Si. Tratta messaggi, chiamate o richieste di pagamento come sospette finche non le verifichi da un canale ufficiale.
Quali sono i primi segnali?
An unsolicited call or SMS from "IT" pressuring you to update a passkey or MFA right now . A sign in link arriving on your personal phone via SMS or Teams from a coworker who never mentioned anything offline. Being asked to approve a device code prompt or paste a code you didn't request this grants the attacker your session
Cosa devo fare subito?
Hang up and call your IT desk on the number listed in the corporate directory; never use the number the caller gives you. Never enter credentials or approve a code on a site you didn't navigate to yourself. Report the call immediately to
LegalAudit puo controllare il mio caso?
Si. Apri la chat gratis e incolla messaggio, link, mittente o dati di pagamento per un triage.