Passkey-themed phishing attacks lead to Microsoft 365 data theft

Threat actors are using passkey-themed phishing to trick employees into providing access to Microsoft 365 accounts for data theft. These attackers employ social engineering and device-code authentication to capture credentials and session tokens before systematically exfiltrating sensitive organizational information.