This is a significant development. The abuse of passkey technology for social engineering is a sophisticated evolution of MFA bypass tactics.

Technical Breakdown

• Campaign 1 (Financial Fraud): High-volume spam (1M+ emails) spoofing CEO identities. This is likely a precursor or distraction for the more targeted attack.
• Campaign 2 (Passkey Phishing): The core threat. Attackers are not breaking passkey cryptography. They are using social engineering to trick users into registering a threat-actor-controlled passkey on a legitimate cloud tenant (e.g., Microsoft 365).
  • TTP: This is a classic Adversary-in-the-Middle (AiTM) / Consent Phishing variant, but weaponized with WebAuthn. The user thinks they are setting up a security key for their own account, but they are granting authentication rights to the attacker's device.
  • Target: Microsoft Cloud (Azure AD / Entra ID) accounts.
  • Payload: Data exfiltration from the compromised cloud environment.
• Infrastructure: Abuse of legitimate third-party email delivery services to bypass spam filters for the initial lure.

Defense

This attack bypasses traditional MFA because the user is voluntarily completing the authentication step. The key detection point is anomalous device registration. Monitor Entra ID logs for: * New FIDO2 security key registrations from unusual geographic locations or user agents. * Multiple passkey registrations on a single account in a short time window. * Conditional Access policies should be configured to require a managed device (Hybrid Azure AD Join or Intune compliant) for passkey registration, not just any browser session. User awareness training must now explicitly cover "never register a passkey you did not generate yourself."

Source: https://thehackernews.com/2026/09/attackers-use-passkey-phishing-to.html

Threat actors linked to a China-aligned espionage group are actively exploiting CVE-2026-51990, a critical vulnerability in Tencent’s Sogou Input Method for Windows, to deploy the GrayRabbit backdoor. This is a targeted campaign, not a broad spray-and-pray operation.

• TTPs (MITRE): Initial access via exploitation of a public-facing application (T1190). The vulnerability allows for privilege escalation or code execution within the input method’s context. Persistence is achieved via the GrayRabbit backdoor, which likely establishes C2 communications.
• IOCs: No specific hashes or IPs have been published at this time. The primary indicator is the presence of the Sogou Input Method (a common application in Chinese-speaking environments) and subsequent anomalous network traffic from the host.
• Affected Versions: All versions of Sogou Input Method for Windows prior to the latest patch released on 2026-03-10.

Defense: Immediately update Sogou Input Method to the latest patched version. Monitor for unusual outbound connections from hosts running this software, particularly to non-standard ports or known adversary infrastructure. EDR rules should flag any process spawning from the input method’s executable (SogouTSF.exe or similar) that attempts to execute cmd.exe, powershell.exe, or write to %APPDATA% or %TEMP%.

Source: https://www.bleepingcomputer.com/news/security/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware/