Date: 09/11/2026
Severity: High
Summary
Storm-3121, Storm-3032, and other threat actors performed a Passkey-themed social engineering campaign that tricks users into fraudulent authentication workflows, leading to identity and cloud compromise. The activity combines phishing, credential theft, account takeover, exfiltration and social engineering to obtain access to cloud resources. The campaign highlights the growing abuse of legitimate authentication mechanisms to bypass user security controls and compromise enterprise identities.
Indicators of Compromise (IOC) List
Domain/URLs | passkeyhelpdesk.com secure-passkey.com setupmypasskey.com add-passkey.com integratedsso.com oktasession.com keysyncos.com oskeysync.com oskeysetup.com oskeyregister.com syncmykey.com myconnectkey.com oskeyconnect.com validationsetupac.com portalsetuphub.com |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "passkeyhelpdesk.com" or url like "passkeyhelpdesk.com" or siteurl like "passkeyhelpdesk.com" or domainname like "oskeyconnect.com" or url like "oskeyconnect.com" or siteurl like "oskeyconnect.com" or domainname like "validationsetupac.com" or url like "validationsetupac.com" or siteurl like "validationsetupac.com" or domainname like "add-passkey.com" or url like "add-passkey.com" or siteurl like "add-passkey.com" or domainname like "setupmypasskey.com" or url like "setupmypasskey.com" or siteurl like "setupmypasskey.com" or domainname like "syncmykey.com" or url like "syncmykey.com" or siteurl like "syncmykey.com" or domainname like "keysyncos.com" or url like "keysyncos.com" or siteurl like "keysyncos.com" or domainname like "oskeysetup.com" or url like "oskeysetup.com" or siteurl like "oskeysetup.com" or domainname like "secure-passkey.com" or url like "secure-passkey.com" or siteurl like "secure-passkey.com" or domainname like "oktasession.com" or url like "oktasession.com" or siteurl like "oktasession.com" or domainname like "oskeyregister.com" or url like "oskeyregister.com" or siteurl like "oskeyregister.com" or domainname like "myconnectkey.com" or url like "myconnectkey.com" or siteurl like "myconnectkey.com" or domainname like "portalsetuphub.com" or url like "portalsetuphub.com" or siteurl like "portalsetuphub.com" or domainname like "oskeysync.com" or url like "oskeysync.com" or siteurl like "oskeysync.com" or domainname like "integratedsso.com" or url like "integratedsso.com" or siteurl like "integratedsso.com" |
Reference:
https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/