For the last few years, small business owners have been told that passkeys and modern login methods are the answer to password theft and phishing. That advice was largely true – until now. Microsoft has confirmed that attackers are running sophisticated campaigns that specifically target passkey-based logins to break into Microsoft 365 cloud accounts, along with a separate mass email scam impersonating CEOs to trick staff into transferring money. Both campaigns are a timely reminder that no single security tool is a silver bullet, and that regional businesses relying entirely on Microsoft 365 for email, files, and customer data need to pay attention.
According to Microsoft, as reported by The Hacker News, attackers ran two distinct campaigns. The first involved sending over a million scam emails in the space of just two days, impersonating chief executives to pressure staff into approving fraudulent payments or handing over sensitive information – a classic business email compromise (BEC) scam, but at enormous scale, using legitimate third-party email delivery services to slip past spam filters.
The second campaign is more concerning from a technical standpoint. Attackers used “passkey-themed” social engineering – essentially tricking users into approving fake passkey registration or login prompts – to gain access to Microsoft cloud accounts and steal data. Passkeys are meant to be phishing-resistant because they rely on cryptographic keys stored on a device rather than a password that can be typed into a fake website. But this campaign shows that if an attacker can convince a user to approve a malicious prompt, or exploit weaknesses in how passkeys are enrolled and recovered, the “phishing-resistant” label doesn’t hold up in the real world.
Most small and medium businesses in Gippsland and regional Victoria run their email, documents, and often their accounting or customer records through Microsoft 365. It’s the front door to almost everything the business does digitally. If that front door is breached, the consequences aren’t abstract – they’re very real and very local:
The scary part of the CEO impersonation scam is how ordinary it looks. A staff member gets an email that appears to come from the boss, asking for an urgent bank transfer or gift card purchase before end of day. In a small business with a handful of admin staff and no dedicated IT security team, there’s often nobody double-checking these requests before money moves.
It’s important not to overreact here. Passkeys remain significantly more secure than passwords alone, and multi-factor authentication in general still blocks the vast majority of automated attacks. The problem isn’t the technology – it’s that attackers have shifted their focus to tricking the human in the loop, rather than trying to brute-force the login itself. This is the same pattern we’ve seen with MFA fatigue attacks and one-time-code phishing over the past couple of years: as technical defences improve, scammers simply target the person clicking “approve.”
That means the solution isn’t to abandon passkeys or MFA, but to pair them with staff awareness and sensible processes that don’t rely purely on technology to save the day.
Cybercriminals are increasingly professional and are constantly adapting to whatever defence becomes popular. Passkeys were supposed to end phishing for good; instead, attackers simply found a new way to exploit human trust rather than technical weakness. For a small business without a dedicated security team, the best defence isn’t chasing every new technology trend – it’s building simple, consistent habits: verify before you trust, question anything urgent, and make sure more than one person has to sign off before money or sensitive data leaves the building.
Regional businesses are just as attractive a target as capital city firms – sometimes more so, because attackers assume smaller teams mean less scrutiny. Treating account security and payment verification as a normal part of daily operations, rather than an IT afterthought, is what will keep a convincing scam email from turning into a genuine financial loss.
If you’re not sure whether your business is exposed to this kind of risk, Maximum IT Solutions offers a free security assessment for businesses across Gippsland and regional Victoria. We’ll review your current setup and flag anything that needs urgent attention — no obligation.
(+61) 0412 440 804
