Attackers Are Switching Off Hardware Keys Mid-Login, and the SMS Fallback Lets Them In

Hardware security keys and passkeys were supposed to end the phishing problem for the accounts that matter most, and on their own terms they have. The cryptography binds every sign-in to the real site, so a lookalike page gets nothing it can replay. Attackers have stopped arguing with that. Across three campaigns documented in the past seven weeks, the move is the same: make the strong method disappear from the login screen, or talk the user out of it, and collect whatever the weaker fallback produces. Organizations that bought keys but kept SMS codes, push approvals and email links as equal alternatives have, in effect, published which door to use.

Lookalike Portals Built Around the Fallback

The newest activity is in an October 19 intel brief from Dataminr's TRACE team. Since late July, it has watched several waves of domain registrations that pair a target company's name with Okta or ServiceNow, such as riskified-okta[.]com and shipmonk-servicenow[.]com, both identified on October 18, and gladly-okta[.]com about 20 hours later. With ten earlier domains, the campaign now accounts for 13 indicators. The pages imitate single sign-on portals, and the lure is aimed squarely at YubiKey users: where policy allows a fallback such as an SMS or email code, the attacker can step around the hardware key entirely.

The phishing pages are backed by phone calls. TRACE describes vishing that includes MFA fatigue bombing and, in more advanced cases, AI-cloned executive voices used to pressure employees. Since September the targets have concentrated on e-commerce SaaS and infrastructure providers, including marketing platforms, logistics partners, payment providers and fraud prevention vendors, several of them hit more than once. TRACE's assessment is that these firms are chosen for their customers: a breach at a provider opens the door to downstream third-party compromises and more leverage for data extortion.

A Phishing Kit That Deletes the Passkey Option

Where Dataminr's campaign relies on persuasion, BigBear 2.0 does it in code. CloudSEK's analysis of the Evilginx2-based kit, first spotted in June, found that its panel injects JavaScript into every proxied Microsoft 365 login page. The script makes the browser's PublicKeyCredential interface undefined and patches the WebAuthn calls to reject public-key options, so a user with a security key is never offered it and falls back to SMS, a one-time password or an authenticator code, all of which the proxy can relay. When the victim completes that weaker challenge, the proxy keeps the resulting session cookie.

The panel CloudSEK examined held 5,137 records from 3,331 unique victim IP addresses across 461 targeted organizations in more than 40 countries, including 1,032 plaintext passwords and 4,148 session cookies. It logged 474 complete authentications in which MFA was bypassed, 9.2% of the records. The operation looks like a product rather than a crew: CloudSEK identified at least five affiliate operators receiving stolen sessions through live Telegram bots, and 42 VPS nodes over the campaign's life, 26 of which the actor deleted from late July. A kit with resellers and affiliates will be copied, and the FIDO-stripping script is a few lines long.

The Help Desk Call That Ends in a New MFA Device

The third campaign targets enrollment rather than the login page. In a September 9 report, Microsoft describes callers posing as IT help desk staff who phone or text employees' personal numbers about an urgent passkey, MFA or SSO update. The activity, seen since May 2026, is linked to Storm-3121, whose access leads to ShinyHunters and Falcon extortion, and to Storm-3032, which operates under the Helix banner. Victims land on lookalike Microsoft pages on domains such as company-name.secure-passkey[.]com, often running within hours of registration, and are led into adversary-in-the-middle or device code phishing. The attackers then register their own phone, authenticator app or software token, map the tenant through Microsoft Graph, and pull SharePoint, OneDrive and Exchange data at fewer than 1,000 files or emails an hour, over hours or days.

HID Global's Sebastien Paquet, analysing the Microsoft report on October 6, makes the point the three campaigns share: no FIDO private key was stolen and no signature was replayed. The flows around the authenticator failed, in particular phishable fallbacks that satisfy the same policy as a passkey, device code sign-ins, and enrollment that an emailed link or a help desk call can authorize. His summary of the fix is "Enrollment ceases to be an online form and becomes a regulated act."

Closing the Downgrade Path

The guidance from Dataminr, CloudSEK, Microsoft and HID converges on making the strong method the only acceptable one wherever it has been deployed.

• Remove phishable fallbacks, not just deprioritize them. If an SMS code or a context-free push can satisfy the same Conditional Access policy as a key, the key adds no protection against these kits. Require a phishing-resistant authentication strength for administrators and high-value users.
• Lock down security info registration. Microsoft recommends a fresh interactive sign-in for every new method, managed devices or named locations, phishing-resistant strength, and blocking registration when sign-in risk is high.
• Block device code and authentication transfer flows. Turn them off in Conditional Access unless a documented business need exists, and scope any exception tightly.
• Rebuild help desk resets. No factor resets on inbound calls, documented identity checks, callbacks through official numbers, and a standing message to staff that support never asks for passkey changes by phone.
• Hunt for the downgrade itself. Alert when a user who normally signs in with FIDO2 suddenly uses SMS or OTP, and when a new MFA device is enrolled shortly after a sign-in from an unexpected IP, as Dataminr advises.
• Revoke sessions, not just passwords. CloudSEK's and Microsoft's remediation steps both start with revoking session and refresh tokens and removing attacker-registered methods, because a stolen cookie outlives a password reset.

Hardware keys remain the strongest sign-in control most organizations can deploy, and nothing in these reports changes that. What they change is the definition of deployed. A key that the login page can hide, or that a convincing caller can replace with a new phone number, protects an account only as well as the weakest method sitting next to it.