Microsoft disclosed in September that attackers used passkey-themed social engineering, messages disguised as legitimate passkey setup prompts, to breach cloud environments and then blast out financial-fraud scam messages. Social engineering is tricking a person into granting access, rather than breaking software directly.
The twist is notable because passkeys are a genuinely strong, phishing-resistant login method, and attackers here impersonated the very security feature meant to protect users.
What it means: the strongest technology still fails if a person is fooled into misusing it. The defence is a simple habit: no legitimate security prompt arrives by surprise message asking you to act immediately. When in doubt, staff should reach the service through its official app or website, not through the link they were sent.