Threat actors Storm-3032 (UNC6671/Helix) and Storm-3121 are executing identity campaigns weaponizing enterprise transitions to passwordless authentication. Operating via targeted vishing and SMS to personal devices, the actors direct employees to counterfeit subdomains spoofing corporate help desks to mandate urgent passkey enrollment. Rather than negotiating WebAuthn ceremonies, the infrastructure routes targets into Adversary-in-the-Middle (AitM) reverse proxies or manipulates OAuth 2.0 device-code flows (/oauth2/deviceauth), securing authenticated sessions without requiring credential theft.

Upon gaining access, the adversaries register an actor-controlled MFA method—such as a rogue phone number or software OTP token—within Microsoft Entra ID, establishing persistent access independent of the victim. Threat actors then route through residential proxies to abuse Microsoft Graph REST APIs, enumerating tenant privileges and automating bulk data exfiltration across SharePoint Online, OneDrive, and Exchange Online mailboxes. Microsoft observed intrusions lasting days, with actors rotating separate IP addresses across authentication, directory reconnaissance, and exfiltration to evade behavioral alerting.

Why it matters:

• Subversion of passwordless trust models: Weaponizing passkey pretexts against device-code and AitM channels circumvents traditional multi-factor protections, while rogue MFA registration in Entra ID converts transient session hijacking into persistent tenant access that survives user logouts.
• Device-bound authentication and Graph API telemetry: Organizations must disable device authorization grants where unneeded, enforce FIDO2 hardware keys bound to managed endpoints, and monitor Microsoft Graph REST telemetry for anomalous bulk mailbox and SharePoint file enumeration across proxy networks.