{ "intelligence": { "actors": [ { "confidence": 50, "evidence_id": "930ab33a-b360-4aed-adf7-ba5a8868d063", "name": "Storm-3121, Storm-3032", "role": "mentionné", "type": "Intrusion-Set" } ], "counts": { "actors": 1, "associated_entity_contexts": 0, "deduplicated_iocs": 15, "direct_entities": 39, "direct_relationships": 38, "invalid_iocs": 0, "iocs": 15, "mentioned": 0, "mitre_associated": 0, "mitre_direct": 0, "targets": 0, "techniques": 0, "unsupported_indicators": 8, "vulnerabilities": 0 }, "coverage": { "associated_repertoire_is_incident_evidence": false, "attribution_policy": "explicit-public-relationships-only", "descriptions_publicly_exported": false, "excluded_context_objects": 17, "excluded_graph_objects": 252, "graph_complete": true, "graph_objects": 39, "graph_relationships": 38, "mitre_context_complete": true, "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "status_as_of": "2026-10-10T10:58:42+00:00", "table_preview_limit": 20 }, "direct_entities": [ { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-08T12:45:20.398Z", "created_at": "2026-08-11T12:17:42.822Z", "modified": "2026-09-26T03:36:41.717Z", "updated_at": "2026-09-26T03:36:41.717Z" }, "description_available": false, "entity_type": "Indicator", "id": "16c32f96-ca94-4aef-b469-617aefc010f3", "is_inferred": false, "labels": [ "adversary-in-the-middle", "aitm phishing", "blackfile", "cloud compromise", "credential-harvesting", "data exfiltration", "data-theft-extortion", "helix", "passkey lure", "phishing-resistant-mfa", "pink", "redact", "saas-exfiltration", "social engineering", "vishing" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "indicator--2bb2093d-b15e-58a1-8757-3d0df80d7a1c", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.311Z", "created_at": "2026-09-26T03:36:42.403Z", "modified": "2026-09-26T03:36:46.290Z", "updated_at": "2026-09-26T03:36:46.290Z" }, "description_available": false, "entity_type": "Indicator", "id": "1e21e2a4-12cf-4811-979c-11863362d06e", "is_inferred": false, "labels": [ "aitm phishing", "cloud compromise", "data exfiltration", "passkey lure", "social engineering" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "indicator--ef8f6c21-aea4-5580-95aa-b4c0d8b14913", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.315Z", "created_at": "2026-09-26T03:36:43.201Z", "modified": "2026-09-26T03:36:50.254Z", "updated_at": "2026-09-26T03:36:50.254Z" }, "description_available": false, "entity_type": "Indicator", "id": "28bbc68c-7ae3-45a9-842c-aeadef68c51b", "is_inferred": false, "labels": [ "aitm phishing", "cloud compromise", "data exfiltration", "passkey lure", "social engineering" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "indicator--051925ad-68e1-5425-8bf5-166e6cd06021", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T03:36:21.993Z", "updated_at": "2026-09-26T03:36:23.285Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "2cd4d099-2beb-4fc9-9f35-549765e69450", "is_inferred": false, "labels": [ "aitm phishing", "cloud compromise", "data exfiltration", "passkey lure", "social engineering" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "domain-name--69a144f8-a6f8-5529-9447-d3abacedf1f5", "type": "DomainName" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-08-11T12:16:46.303Z", "updated_at": "2026-09-26T04:29:44.055Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "2ecb7abf-1422-41b6-a34a-1d0e753fc50e", "is_inferred": false, "labels": [ "adversary-in-the-middle", "aitm phishing", "blackfile", "cloud compromise", "credential-harvesting", "data exfiltration", "data-theft-extortion", "extortionware", "helix", "mfa bypass", "microsoft 365", "nodemaven", "passkey lure", "phishing-resistant-mfa", "pink", "redact", "residential proxies", "saas platforms", "saas-exfiltration", "social engineering", "tox messaging", "vishing" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "domain-name--c978901b-1a13-57d1-8fe7-318494c2e5c3", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.330Z", "created_at": "2026-09-26T03:36:44.842Z", "modified": "2026-09-26T03:36:57.934Z", "updated_at": "2026-09-26T03:36:57.934Z" }, "description_available": false, "entity_type": "Indicator", "id": "30cdbe8a-ec17-494e-82e3-ee77db932456", "is_inferred": false, "labels": [ "aitm phishing", "cloud compromise", "data exfiltration", "passkey lure", "social engineering" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "indicator--2faf314f-1120-5809-85c9-339b90e6df2a", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T03:36:14.401Z", "updated_at": "2026-09-26T03:36:15.296Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "3eeea9d8-0823-4f9e-b10e-a21e996d3993", "is_inferred": false, "labels": [ "aitm phishing", "cloud compromise", "data exfiltration", "passkey lure", "social engineering" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "domain-name--d122f7de-e53f-5aff-8c9e-6c5cc8f6dbc2", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.295Z", "created_at": "2026-09-26T03:36:36.340Z", "modified": "2026-09-26T03:36:42.367Z", "updated_at": "2026-09-26T03:36:42.367Z" }, "description_available": false, "entity_type": "Indicator", "id": "4235404a-5fda-48ae-947f-1ac44334008f", "is_inferred": false, "labels": [ "aitm phishing", "cloud compromise", "data exfiltration", "passkey lure", "social engineering" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "indicator--7ac1f025-9f46-58cd-8cd9-045b63014d98", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-08-11T12:16:13.620Z", "updated_at": "2026-09-26T03:36:19.022Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "4248c030-0706-4e2c-953c-68f6e827c93f", "is_inferred": false, "labels": [ "adversary-in-the-middle", "aitm phishing", "blackfile", "cloud compromise", "credential-harvesting", "data exfiltration", "data-theft-extortion", "helix", "passkey lure", "phishing-resistant-mfa", "pink", "redact", "saas-exfiltration", "social engineering", "vishing" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "domain-name--e11959c8-9810-591d-9ab2-3f5595b8317b", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-08T12:29:58.199Z", "created_at": "2026-08-10T09:20:21.788Z", "modified": "2026-09-26T03:36:35.738Z", "updated_at": "2026-09-26T03:36:35.738Z" }, "description_available": false, "entity_type": "Indicator", "id": "47746501-c1e7-4c1f-ae9e-59587b1bc826", "is_inferred": false, "labels": [ "adversary-in-the-middle", "aitm phishing", "blackfile", "cloud compromise", "credential-harvesting", "data exfiltration", "data extortion", "data-theft-extortion", "device code phishing", "helix", "identity-based attacks", "mfa abuse", "passkey lure", "phishing-resistant-mfa", "pink", "redact", "saas-exfiltration", "sharepoint exfiltration", "shinyhunters", "social engineering", "vishing" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "indicator--cf22895e-e2de-5c87-b355-18cab92412e3", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-08T12:45:20.361Z", "created_at": "2026-08-11T12:17:35.777Z", "modified": "2026-09-26T03:36:38.479Z", "updated_at": "2026-09-26T03:36:38.479Z" }, "description_available": false, "entity_type": "Indicator", "id": "49806b02-1f6b-4bdb-a949-9ba6f3e5b646", "is_inferred": false, "labels": [ "adversary-in-the-middle", "aitm phishing", "blackfile", "cloud compromise", "credential-harvesting", "data exfiltration", "data-theft-extortion", "helix", "passkey lure", "phishing-resistant-mfa", "pink", "redact", "saas-exfiltration", "social engineering", "vishing" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "indicator--f5696441-48f9-5b17-9561-fa010c3b6dfc", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T03:36:14.415Z", "updated_at": "2026-09-26T03:36:15.518Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "4a039d8d-31d0-4d40-a9a2-44375675cc1d", "is_inferred": false, "labels": [ "aitm phishing", "cloud compromise", "data exfiltration", "passkey lure", "social engineering" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "domain-name--2c4900bd-e5fb-5cfb-8be5-d7a9acf45d87", "type": "DomainName" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T03:36:24.653Z", "updated_at": "2026-09-26T03:36:25.653Z" }, "description_available": false, "entity_type": "Hostname", "id": "4b4d9807-2eea-4faf-a875-95848bce1046", "is_inferred": false, "labels": [ "aitm phishing", "cloud compromise", "data exfiltration", "passkey lure", "social engineering" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "hostname--59959e46-4706-5fa7-9c4f-e043cd0e86f6", "type": "Hostname" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-08-11T12:16:22.433Z", "updated_at": "2026-09-26T03:36:21.188Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "51789bec-412a-49aa-9a07-33e97165c424", "is_inferred": false, "labels": [ "adversary-in-the-middle", "aitm phishing", "blackfile", "cloud compromise", "credential-harvesting", "data exfiltration", "data-theft-extortion", "helix", "passkey lure", "phishing-resistant-mfa", "pink", "redact", "saas-exfiltration", "social engineering", "vishing" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "domain-name--9006d36e-03e5-54f4-9d44-a4fb79d24e0e", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.334Z", "created_at": "2026-09-26T03:36:45.366Z", "modified": "2026-09-26T03:37:01.056Z", "updated_at": "2026-09-26T03:37:01.056Z" }, "description_available": false, "entity_type": "Indicator", "id": "5f39b1c8-88d3-485a-b2ee-842a9b086646", "is_inferred": false, "labels": [ "aitm phishing", "cloud compromise", "data exfiltration", "passkey lure", "social engineering" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "indicator--5bfb4dcf-6d35-5520-98a0-c7fbaa136baf", "type": "Indicator" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T03:36:26.231Z", "updated_at": "2026-09-26T03:36:30.873Z" }, "description_available": false, "entity_type": "Hostname", "id": "606856fd-83e8-44df-acc8-fce45ce31e90", "is_inferred": false, "labels": [ "aitm phishing", "cloud compromise", "data exfiltration", "passkey lure", "social engineering" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "hostname--e84b4a42-d144-5ec0-8bbc-63eb2c1af778", "type": "Hostname" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-08T12:45:20.442Z", "created_at": "2026-08-11T12:17:59.889Z", "modified": "2026-09-26T04:30:04.197Z", "updated_at": "2026-09-26T04:30:04.197Z" }, "description_available": false, "entity_type": "Indicator", "id": "6fa2176b-f0b6-49e9-a5e6-5930951d4d8e", "is_inferred": false, "labels": [ "adversary-in-the-middle", "aitm phishing", "blackfile", "cloud compromise", "credential-harvesting", "data exfiltration", "data-theft-extortion", "extortionware", "helix", "mfa bypass", "microsoft 365", "nodemaven", "passkey lure", "phishing-resistant-mfa", "pink", "redact", "residential proxies", "saas platforms", "saas-exfiltration", "social engineering", "tox messaging", "vishing" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "indicator--dae13969-7c78-53c6-8a5f-a83d5cdacbef", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.300Z", "created_at": "2026-09-26T03:36:37.792Z", "modified": "2026-09-26T04:30:03.529Z", "updated_at": "2026-09-26T04:30:03.529Z" }, "description_available": false, "entity_type": "Indicator", "id": "7484b670-951f-40e5-8177-bde2650e80b8", "is_inferred": false, "labels": [ "aitm phishing", "cloud compromise", "data exfiltration", "extortionware", "mfa bypass", "microsoft 365", "nodemaven", "passkey lure", "residential proxies", "saas platforms", "social engineering", "tox messaging", "vishing" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "indicator--b8490a7b-3eaa-51f5-a4cc-1e4cfcd57655", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-08T12:45:20.359Z", "created_at": "2026-08-11T12:17:35.777Z", "modified": "2026-09-26T03:36:36.585Z", "updated_at": "2026-09-26T03:36:36.585Z" }, "description_available": false, "entity_type": "Indicator", "id": "7568f918-944d-4ad5-8a77-6007a061b949", "is_inferred": false, "labels": [ "adversary-in-the-middle", "aitm phishing", "blackfile", "cloud compromise", "credential-harvesting", "data exfiltration", "data-theft-extortion", "helix", "passkey lure", "phishing-resistant-mfa", "pink", "redact", "saas-exfiltration", "social engineering", "vishing" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "indicator--b0d10bfc-c376-53a6-9cf7-e62b7d757f1f", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T03:36:17.458Z", "updated_at": "2026-09-26T03:36:18.289Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "803d0ea5-2641-4412-96f2-ea37ecfe363c", "is_inferred": false, "labels": [ "aitm phishing", "cloud compromise", "data exfiltration", "passkey lure", "social engineering" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "domain-name--b4781d01-0c81-5115-aeb5-c41bac92ce34", "type": "DomainName" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T03:36:18.915Z", "updated_at": "2026-09-26T04:29:33.439Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "82733e65-81b1-4f0b-94e6-744f13fcfdf3", "is_inferred": false, "labels": [ "aitm phishing", "cloud compromise", "data exfiltration", "extortionware", "mfa bypass", "microsoft 365", "nodemaven", "passkey lure", "residential proxies", "saas platforms", "social engineering", "tox messaging", "vishing" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "domain-name--e29af492-812a-539f-8a37-5b21f12e9d76", "type": "DomainName" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T03:36:24.654Z", "updated_at": "2026-09-26T03:36:25.418Z" }, "description_available": false, "entity_type": "Hostname", "id": "84486369-7ff2-478a-bd8d-cb94564bd6a0", "is_inferred": false, "labels": [ "aitm phishing", "cloud compromise", "data exfiltration", "passkey lure", "social engineering" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "hostname--1ba53260-1004-5161-a56c-5e08be4a49f1", "type": "Hostname" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-08T12:45:20.477Z", "created_at": "2026-08-11T12:18:12.812Z", "modified": "2026-09-26T04:30:04.040Z", "updated_at": "2026-09-26T04:30:04.040Z" }, "description_available": false, "entity_type": "Indicator", "id": "86684b55-771b-4a7f-be5a-72448fc8ee3e", "is_inferred": false, "labels": [ "adversary-in-the-middle", "aitm phishing", "blackfile", "cloud compromise", "credential-harvesting", "data exfiltration", "data-theft-extortion", "extortionware", "helix", "mfa bypass", "microsoft 365", "nodemaven", "passkey lure", "phishing-resistant-mfa", "pink", "redact", "residential proxies", "saas platforms", "saas-exfiltration", "social engineering", "tox messaging", "vishing" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "indicator--daca2020-e3e2-596c-9749-9555cc700686", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.313Z", "created_at": "2026-09-26T03:36:43.030Z", "modified": "2026-09-26T03:36:49.156Z", "updated_at": "2026-09-26T03:36:49.156Z" }, "description_available": false, "entity_type": "Indicator", "id": "87e30152-cae3-47b0-9dd1-7b2db3541b08", "is_inferred": false, "labels": [ "aitm phishing", "cloud compromise", "data exfiltration", "passkey lure", "social engineering" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "indicator--67f6bccf-387d-53fd-9eea-c72c3285a3df", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-08-10T09:20:19.180Z", "updated_at": "2026-09-26T03:36:17.351Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "899de763-5741-49b9-8f4a-5bd9f5ea88cf", "is_inferred": false, "labels": [ "adversary-in-the-middle", "aitm phishing", "blackfile", "cloud compromise", "credential-harvesting", "data exfiltration", "data extortion", "data-theft-extortion", "device code phishing", "helix", "identity-based attacks", "mfa abuse", "passkey lure", "phishing-resistant-mfa", "pink", "redact", "saas-exfiltration", "sharepoint exfiltration", "shinyhunters", "social engineering", "vishing" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "domain-name--d822d005-83d1-5da7-b5e2-d88852c5184f", "type": "DomainName" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-08-11T12:16:13.366Z", "updated_at": "2026-09-26T03:36:18.510Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "906e1606-d589-4526-90f4-fffc23499b7b", "is_inferred": false, "labels": [ "adversary-in-the-middle", "aitm phishing", "blackfile", "cloud compromise", "credential-harvesting", "data exfiltration", "data-theft-extortion", "helix", "passkey lure", "phishing-resistant-mfa", "pink", "redact", "saas-exfiltration", "social engineering", "vishing" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "domain-name--ab1f305a-39cd-5810-8e75-20464c4f1748", "type": "DomainName" }, { "__typename": "IntrusionSet", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.263Z", "created_at": "2026-09-26T03:36:10.213Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-26T03:36:11.689Z", "updated_at": "2026-09-26T03:36:11.689Z" }, "description_available": false, "entity_type": "Intrusion-Set", "id": "930ab33a-b360-4aed-adf7-ba5a8868d063", "is_inferred": false, "labels": [], "lang": "en", "name": "Storm-3121, Storm-3032", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "intrusion-set--4f9967c8-1ad1-5fd2-bcea-f576b309e092", "type": "IntrusionSet" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-08T12:45:20.332Z", "created_at": "2026-08-11T12:17:29.103Z", "modified": "2026-09-26T03:36:35.739Z", "updated_at": "2026-09-26T03:36:35.739Z" }, "description_available": false, "entity_type": "Indicator", "id": "9911d2ed-8417-4071-b776-dc5cc40b7622", "is_inferred": false, "labels": [ "adversary-in-the-middle", "aitm phishing", "blackfile", "cloud compromise", "credential-harvesting", "data exfiltration", "data-theft-extortion", "helix", "passkey lure", "phishing-resistant-mfa", "pink", "redact", "saas-exfiltration", "social engineering", "vishing" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "indicator--7ba00299-7a80-57a2-a9f6-a1cf2f4525c0", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-08-11T12:16:07.940Z", "updated_at": "2026-09-26T03:36:17.069Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "9da4b2eb-d4e4-46e1-95f1-53e84f7784a7", "is_inferred": false, "labels": [ "adversary-in-the-middle", "aitm phishing", "blackfile", "cloud compromise", "credential-harvesting", "data exfiltration", "data-theft-extortion", "helix", "passkey lure", "phishing-resistant-mfa", "pink", "redact", "saas-exfiltration", "social engineering", "vishing" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "domain-name--961223b1-92e2-56a5-aa01-01af0025668b", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.282Z", "created_at": "2026-09-26T03:36:30.529Z", "modified": "2026-09-26T03:36:36.966Z", "updated_at": "2026-09-26T03:36:36.966Z" }, "description_available": false, "entity_type": "Indicator", "id": "ad48e088-cb9a-475e-8236-51e766e3167e", "is_inferred": false, "labels": [ "aitm phishing", "cloud compromise", "data exfiltration", "passkey lure", "social engineering" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "indicator--53bf5e46-9a0a-51d4-8d18-dde9d872185c", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-08T12:45:20.326Z", "created_at": "2026-08-11T12:17:25.918Z", "modified": "2026-09-26T03:36:34.606Z", "updated_at": "2026-09-26T03:36:34.606Z" }, "description_available": false, "entity_type": "Indicator", "id": "b48059db-4c72-4e19-a8a9-6adf0f5d6880", "is_inferred": false, "labels": [ "adversary-in-the-middle", "aitm phishing", "blackfile", "cloud compromise", "credential-harvesting", "data exfiltration", "data-theft-extortion", "helix", "passkey lure", "phishing-resistant-mfa", "pink", "redact", "saas-exfiltration", "social engineering", "vishing" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "indicator--68697926-668b-5dd5-8d8c-2707adeb0b8f", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-08-11T12:16:33.376Z", "updated_at": "2026-09-26T04:29:44.056Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "b6959eed-59f4-40b7-9385-10ba827eda7b", "is_inferred": false, "labels": [ "adversary-in-the-middle", "aitm phishing", "blackfile", "cloud compromise", "credential-harvesting", "data exfiltration", "data-theft-extortion", "extortionware", "helix", "mfa bypass", "microsoft 365", "nodemaven", "passkey lure", "phishing-resistant-mfa", "pink", "redact", "residential proxies", "saas platforms", "saas-exfiltration", "social engineering", "tox messaging", "vishing" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "domain-name--64febfc4-79dc-56d0-8c24-d56a36882008", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.325Z", "created_at": "2026-09-26T03:36:44.839Z", "modified": "2026-09-26T03:36:55.011Z", "updated_at": "2026-09-26T03:36:55.011Z" }, "description_available": false, "entity_type": "Indicator", "id": "ce7926f6-f65c-46a6-a6f0-6e65cb31ee70", "is_inferred": false, "labels": [ "aitm phishing", "cloud compromise", "data exfiltration", "passkey lure", "social engineering" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "indicator--3d261f8f-720d-50df-9a0a-47390698065c", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T03:36:21.994Z", "updated_at": "2026-09-26T03:36:23.286Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "d346995b-fd3b-4117-bdde-2b6d8c23503a", "is_inferred": false, "labels": [ "aitm phishing", "cloud compromise", "data exfiltration", "passkey lure", "social engineering" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "domain-name--a2c95a1f-b7e2-559a-997b-440a8e21c300", "type": "DomainName" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T03:36:25.047Z", "updated_at": "2026-09-26T03:36:25.654Z" }, "description_available": false, "entity_type": "Hostname", "id": "dc7b1481-5922-4f1e-a155-e792f9ea8bd3", "is_inferred": false, "labels": [ "aitm phishing", "cloud compromise", "data exfiltration", "passkey lure", "social engineering" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "hostname--870e3798-df00-5f9c-a973-6e5ee4d88ed7", "type": "Hostname" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.279Z", "created_at": "2026-09-26T03:36:28.906Z", "modified": "2026-09-26T03:36:34.775Z", "updated_at": "2026-09-26T03:36:34.775Z" }, "description_available": false, "entity_type": "Indicator", "id": "dc88cc5c-a198-4be9-ab3b-521d1942d004", "is_inferred": false, "labels": [ "aitm phishing", "cloud compromise", "data exfiltration", "passkey lure", "social engineering" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "indicator--9390cd74-c830-579c-b66d-d243ee93fa1f", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.320Z", "created_at": "2026-09-26T03:36:44.285Z", "modified": "2026-09-26T03:36:52.591Z", "updated_at": "2026-09-26T03:36:52.591Z" }, "description_available": false, "entity_type": "Indicator", "id": "e2350c2a-39e3-494f-8618-aa23c717cf22", "is_inferred": false, "labels": [ "aitm phishing", "cloud compromise", "data exfiltration", "passkey lure", "social engineering" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "indicator--a35bae63-2fb7-55fe-8907-01394aee87cf", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-08-11T12:16:06.606Z", "updated_at": "2026-09-26T03:36:15.801Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "f22f832f-079d-42d1-8b1f-230246b9e96c", "is_inferred": false, "labels": [ "adversary-in-the-middle", "aitm phishing", "blackfile", "cloud compromise", "credential-harvesting", "data exfiltration", "data-theft-extortion", "helix", "passkey lure", "phishing-resistant-mfa", "pink", "redact", "saas-exfiltration", "social engineering", "vishing" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "domain-name--88b6de1f-a4cb-50c8-b8a6-2e2297325075", "type": "DomainName" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T03:36:23.625Z", "updated_at": "2026-09-26T03:36:24.178Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "f738b88a-d51d-4f1c-9ef6-d1532d58b2f6", "is_inferred": false, "labels": [ "aitm phishing", "cloud compromise", "data exfiltration", "passkey lure", "social engineering" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "domain-name--c163b1ae-6f54-5308-b5dc-f0266d6fdbed", "type": "DomainName" } ], "direct_relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.411Z", "created_at": "2026-09-26T03:38:46.731Z", "modified": "2026-09-26T03:38:47.136Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T03:38:47.136Z" }, "description_available": false, "entity_type": "indicates", "fromId": "6fa2176b-f0b6-49e9-a5e6-5930951d4d8e", "from_id": "6fa2176b-f0b6-49e9-a5e6-5930951d4d8e", "from_name": null, "from_type": "Indicator", "id": "078c6fb6-2813-4c49-9a83-c4938fa69100", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--130dcb76-7592-5281-80d5-b289fb5721d5", "toId": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_id": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_name": "Storm-3121, Storm-3032", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.284Z", "created_at": "2026-09-26T03:37:05.457Z", "modified": "2026-09-26T03:37:05.883Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T03:37:05.883Z" }, "description_available": false, "entity_type": "based-on", "fromId": "ad48e088-cb9a-475e-8236-51e766e3167e", "from_id": "ad48e088-cb9a-475e-8236-51e766e3167e", "from_name": null, "from_type": "Indicator", "id": "0919d033-6ed4-43a9-8f61-aba6dce59ab8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--87868453-607b-586e-97dc-14acf30c2b6b", "toId": "3eeea9d8-0823-4f9e-b10e-a21e996d3993", "to_id": "3eeea9d8-0823-4f9e-b10e-a21e996d3993", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-08T12:45:20.328Z", "created_at": "2026-08-11T12:20:29.285Z", "modified": "2026-08-11T12:20:30.421Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-08-11T12:20:30.421Z" }, "description_available": false, "entity_type": "based-on", "fromId": "b48059db-4c72-4e19-a8a9-6adf0f5d6880", "from_id": "b48059db-4c72-4e19-a8a9-6adf0f5d6880", "from_name": null, "from_type": "Indicator", "id": "0b20fb5f-ef26-4ae7-840e-d18a07b15669", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--a35b9cc7-72a9-5d77-b002-2ede9b5ae30f", "toId": "f22f832f-079d-42d1-8b1f-230246b9e96c", "to_id": "f22f832f-079d-42d1-8b1f-230246b9e96c", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.397Z", "created_at": "2026-09-26T03:38:25.185Z", "modified": "2026-09-26T03:38:25.497Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T03:38:25.497Z" }, "description_available": false, "entity_type": "indicates", "fromId": "7484b670-951f-40e5-8177-bde2650e80b8", "from_id": "7484b670-951f-40e5-8177-bde2650e80b8", "from_name": null, "from_type": "Indicator", "id": "19c7c831-5a05-4609-bb04-4e6fae1a409f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--4dc3f847-e421-539b-be4b-a39983dba7e9", "toId": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_id": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_name": "Storm-3121, Storm-3032", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.439Z", "created_at": "2026-09-26T03:39:19.319Z", "modified": "2026-09-26T03:39:19.658Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T03:39:19.658Z" }, "description_available": false, "entity_type": "indicates", "fromId": "28bbc68c-7ae3-45a9-842c-aeadef68c51b", "from_id": "28bbc68c-7ae3-45a9-842c-aeadef68c51b", "from_name": null, "from_type": "Indicator", "id": "1bad012d-ea54-435c-b96b-bb46dda2f30a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--f3883861-6f26-5050-b046-05e222bdb218", "toId": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_id": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_name": "Storm-3121, Storm-3032", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.453Z", "created_at": "2026-09-26T03:39:36.262Z", "modified": "2026-09-26T03:39:38.104Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T03:39:38.104Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ce7926f6-f65c-46a6-a6f0-6e65cb31ee70", "from_id": "ce7926f6-f65c-46a6-a6f0-6e65cb31ee70", "from_name": null, "from_type": "Indicator", "id": "2084fa03-3bbf-4679-9a30-311192d34a7e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--75ec1926-56a7-50be-9cf5-e6bb6e2a9dee", "toId": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_id": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_name": "Storm-3121, Storm-3032", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-08T12:45:20.362Z", "created_at": "2026-08-11T12:20:37.150Z", "modified": "2026-08-11T12:20:41.046Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-08-11T12:20:41.046Z" }, "description_available": false, "entity_type": "based-on", "fromId": "49806b02-1f6b-4bdb-a949-9ba6f3e5b646", "from_id": "49806b02-1f6b-4bdb-a949-9ba6f3e5b646", "from_name": null, "from_type": "Indicator", "id": "27632cd1-a037-4c5c-a430-904362643cbf", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--1769d02b-2a9a-5911-9193-3c70f963ab94", "toId": "4248c030-0706-4e2c-953c-68f6e827c93f", "to_id": "4248c030-0706-4e2c-953c-68f6e827c93f", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.418Z", "created_at": "2026-09-26T03:38:54.783Z", "modified": "2026-09-26T03:38:55.028Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T03:38:55.028Z" }, "description_available": false, "entity_type": "indicates", "fromId": "86684b55-771b-4a7f-be5a-72448fc8ee3e", "from_id": "86684b55-771b-4a7f-be5a-72448fc8ee3e", "from_name": null, "from_type": "Indicator", "id": "296512a1-d10f-4449-a77f-246c16e219df", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--952607d4-a918-5717-ae2f-aa6a15e794f6", "toId": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_id": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_name": "Storm-3121, Storm-3032", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.446Z", "created_at": "2026-09-26T03:39:26.097Z", "modified": "2026-09-26T03:39:28.626Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T03:39:28.626Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e2350c2a-39e3-494f-8618-aa23c717cf22", "from_id": "e2350c2a-39e3-494f-8618-aa23c717cf22", "from_name": null, "from_type": "Indicator", "id": "313bb84b-1391-4e48-8ac7-356afbbb59e3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--57feee59-c794-5ad6-9b13-00bba4a5dd2c", "toId": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_id": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_name": "Storm-3121, Storm-3032", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.337Z", "created_at": "2026-09-26T03:37:10.260Z", "modified": "2026-09-26T03:37:10.691Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T03:37:10.691Z" }, "description_available": false, "entity_type": "based-on", "fromId": "5f39b1c8-88d3-485a-b2ee-842a9b086646", "from_id": "5f39b1c8-88d3-485a-b2ee-842a9b086646", "from_name": null, "from_type": "Indicator", "id": "3c551dc8-31e8-409f-854e-09f21099280a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--8aae5fa5-a052-5e34-9fa2-4d260cf821ce", "toId": "606856fd-83e8-44df-acc8-fce45ce31e90", "to_id": "606856fd-83e8-44df-acc8-fce45ce31e90", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-08T12:29:58.201Z", "created_at": "2026-08-10T09:20:26.716Z", "modified": "2026-08-10T09:20:27.424Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-08-10T09:20:27.424Z" }, "description_available": false, "entity_type": "based-on", "fromId": "47746501-c1e7-4c1f-ae9e-59587b1bc826", "from_id": "47746501-c1e7-4c1f-ae9e-59587b1bc826", "from_name": null, "from_type": "Indicator", "id": "4142fb72-55ad-4d7e-b000-2dc7c3ab8105", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--a04790d3-cc9a-5926-94cf-86a3920c9f1f", "toId": "899de763-5741-49b9-8f4a-5bd9f5ea88cf", "to_id": "899de763-5741-49b9-8f4a-5bd9f5ea88cf", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.432Z", "created_at": "2026-09-26T03:39:11.014Z", "modified": "2026-09-26T03:39:11.131Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T03:39:11.131Z" }, "description_available": false, "entity_type": "indicates", "fromId": "87e30152-cae3-47b0-9dd1-7b2db3541b08", "from_id": "87e30152-cae3-47b0-9dd1-7b2db3541b08", "from_name": null, "from_type": "Indicator", "id": "424bc655-dc7d-4dd0-baa9-c5274784818b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--be0e56b6-f669-53c1-871c-056279134279", "toId": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_id": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_name": "Storm-3121, Storm-3032", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-08T12:45:20.334Z", "created_at": "2026-08-11T12:20:32.420Z", "modified": "2026-08-11T12:20:33.519Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-08-11T12:20:33.519Z" }, "description_available": false, "entity_type": "based-on", "fromId": "9911d2ed-8417-4071-b776-dc5cc40b7622", "from_id": "9911d2ed-8417-4071-b776-dc5cc40b7622", "from_name": null, "from_type": "Indicator", "id": "45579207-de6d-4640-895b-92b0aaa1cef4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--d9f50897-3a40-54d3-af35-37c6baa6e81a", "toId": "9da4b2eb-d4e4-46e1-95f1-53e84f7784a7", "to_id": "9da4b2eb-d4e4-46e1-95f1-53e84f7784a7", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.323Z", "created_at": "2026-09-26T03:37:09.194Z", "modified": "2026-09-26T03:37:09.546Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T03:37:09.546Z" }, "description_available": false, "entity_type": "based-on", "fromId": "e2350c2a-39e3-494f-8618-aa23c717cf22", "from_id": "e2350c2a-39e3-494f-8618-aa23c717cf22", "from_name": null, "from_type": "Indicator", "id": "46bd5ba3-8b12-40c9-8c55-a688eb20e3f5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--ba736bcb-954d-59ad-b80c-bc5abc156c93", "toId": "4b4d9807-2eea-4faf-a875-95848bce1046", "to_id": "4b4d9807-2eea-4faf-a875-95848bce1046", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.369Z", "created_at": "2026-09-26T03:37:48.520Z", "modified": "2026-09-26T03:37:50.153Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T03:37:50.153Z" }, "description_available": false, "entity_type": "indicates", "fromId": "47746501-c1e7-4c1f-ae9e-59587b1bc826", "from_id": "47746501-c1e7-4c1f-ae9e-59587b1bc826", "from_name": null, "from_type": "Indicator", "id": "49491e4d-7915-48ff-8dc8-05507c25d242", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--78c79870-e80d-5108-8625-26e47194092b", "toId": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_id": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_name": "Storm-3121, Storm-3032", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.332Z", "created_at": "2026-09-26T03:37:09.613Z", "modified": "2026-09-26T03:37:10.142Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T03:37:10.142Z" }, "description_available": false, "entity_type": "based-on", "fromId": "30cdbe8a-ec17-494e-82e3-ee77db932456", "from_id": "30cdbe8a-ec17-494e-82e3-ee77db932456", "from_name": null, "from_type": "Indicator", "id": "51220ec1-dafd-4c9b-94a6-effafb529868", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--7af60c5f-db5e-5ea0-a77d-7ce7e9abb69e", "toId": "dc7b1481-5922-4f1e-a155-e792f9ea8bd3", "to_id": "dc7b1481-5922-4f1e-a155-e792f9ea8bd3", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.383Z", "created_at": "2026-09-26T03:38:08.850Z", "modified": "2026-09-26T03:38:09.078Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T03:38:09.078Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4235404a-5fda-48ae-947f-1ac44334008f", "from_id": "4235404a-5fda-48ae-947f-1ac44334008f", "from_name": null, "from_type": "Indicator", "id": "57a36f4d-fb11-4eee-a592-848503cc6bd4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--8a007ff5-947c-5d45-b48c-3e64f4d5cff3", "toId": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_id": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_name": "Storm-3121, Storm-3032", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.354Z", "created_at": "2026-09-26T03:37:27.798Z", "modified": "2026-09-26T03:37:28.012Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T03:37:28.012Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b48059db-4c72-4e19-a8a9-6adf0f5d6880", "from_id": "b48059db-4c72-4e19-a8a9-6adf0f5d6880", "from_name": null, "from_type": "Indicator", "id": "5d6b0634-d0d4-4d68-ab07-c1ae91e3b223", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--a2b493da-9a5f-5521-9dc8-e36dd0808a0b", "toId": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_id": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_name": "Storm-3121, Storm-3032", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.362Z", "created_at": "2026-09-26T03:37:38.217Z", "modified": "2026-09-26T03:37:38.632Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T03:37:38.632Z" }, "description_available": false, "entity_type": "indicates", "fromId": "9911d2ed-8417-4071-b776-dc5cc40b7622", "from_id": "9911d2ed-8417-4071-b776-dc5cc40b7622", "from_name": null, "from_type": "Indicator", "id": "69ce8e1f-c771-4562-8dde-f3cf0481467d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--881d82e2-6a1f-57fa-ba12-0935cd244112", "toId": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_id": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_name": "Storm-3121, Storm-3032", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.301Z", "created_at": "2026-09-26T03:37:06.414Z", "modified": "2026-09-26T03:37:06.741Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T03:37:06.741Z" }, "description_available": false, "entity_type": "based-on", "fromId": "7484b670-951f-40e5-8177-bde2650e80b8", "from_id": "7484b670-951f-40e5-8177-bde2650e80b8", "from_name": null, "from_type": "Indicator", "id": "6da4a547-4487-47bc-92dd-b5967137c3da", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--9bb17874-8892-5bed-afd1-95638c907f74", "toId": "82733e65-81b1-4f0b-94e6-744f13fcfdf3", "to_id": "82733e65-81b1-4f0b-94e6-744f13fcfdf3", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.296Z", "created_at": "2026-09-26T03:37:06.165Z", "modified": "2026-09-26T03:37:06.526Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T03:37:06.526Z" }, "description_available": false, "entity_type": "based-on", "fromId": "4235404a-5fda-48ae-947f-1ac44334008f", "from_id": "4235404a-5fda-48ae-947f-1ac44334008f", "from_name": null, "from_type": "Indicator", "id": "7de0c9d3-c486-496f-8f52-373034dddd98", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--24981f3e-c5aa-583d-aae9-7f0f723335f5", "toId": "803d0ea5-2641-4412-96f2-ea37ecfe363c", "to_id": "803d0ea5-2641-4412-96f2-ea37ecfe363c", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.390Z", "created_at": "2026-09-26T03:38:15.208Z", "modified": "2026-09-26T03:38:16.011Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T03:38:16.011Z" }, "description_available": false, "entity_type": "indicates", "fromId": "49806b02-1f6b-4bdb-a949-9ba6f3e5b646", "from_id": "49806b02-1f6b-4bdb-a949-9ba6f3e5b646", "from_name": null, "from_type": "Indicator", "id": "7ee8fc37-248e-416d-8d69-f77e1b7b2728", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--443ba4a4-89fc-55f3-ade9-0b5b748d0584", "toId": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_id": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_name": "Storm-3121, Storm-3032", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.347Z", "created_at": "2026-09-26T03:37:20.582Z", "modified": "2026-09-26T03:37:20.858Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T03:37:20.858Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ad48e088-cb9a-475e-8236-51e766e3167e", "from_id": "ad48e088-cb9a-475e-8236-51e766e3167e", "from_name": null, "from_type": "Indicator", "id": "8e32e893-2125-4a55-800f-1c55d6dafe1a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--4ac75ca0-764c-5b3f-b3e7-3fb971b39ccc", "toId": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_id": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_name": "Storm-3121, Storm-3032", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.375Z", "created_at": "2026-09-26T03:37:58.596Z", "modified": "2026-09-26T03:37:58.692Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T03:37:58.692Z" }, "description_available": false, "entity_type": "indicates", "fromId": "7568f918-944d-4ad5-8a77-6007a061b949", "from_id": "7568f918-944d-4ad5-8a77-6007a061b949", "from_name": null, "from_type": "Indicator", "id": "912bf450-daa9-48d0-99e2-05add73557be", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--247ee70f-7975-5a0c-b64e-14ca50de7c25", "toId": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_id": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_name": "Storm-3121, Storm-3032", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.339Z", "created_at": "2026-09-26T03:37:10.554Z", "modified": "2026-09-26T03:37:10.870Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T03:37:10.870Z" }, "description_available": false, "entity_type": "indicates", "fromId": "dc88cc5c-a198-4be9-ab3b-521d1942d004", "from_id": "dc88cc5c-a198-4be9-ab3b-521d1942d004", "from_name": null, "from_type": "Indicator", "id": "9322edcd-6d7b-481d-9fd1-435641e5faa4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--cb158291-b149-57da-9c05-59d11503a5a0", "toId": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_id": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_name": "Storm-3121, Storm-3032", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.312Z", "created_at": "2026-09-26T03:37:06.936Z", "modified": "2026-09-26T03:37:08.227Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T03:37:08.227Z" }, "description_available": false, "entity_type": "based-on", "fromId": "1e21e2a4-12cf-4811-979c-11863362d06e", "from_id": "1e21e2a4-12cf-4811-979c-11863362d06e", "from_name": null, "from_type": "Indicator", "id": "ada78ddb-c74b-4723-9a6f-214204722ea3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--50a3b0a8-8332-5907-b287-26a68191c68a", "toId": "2cd4d099-2beb-4fc9-9f35-549765e69450", "to_id": "2cd4d099-2beb-4fc9-9f35-549765e69450", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-08T12:45:20.399Z", "created_at": "2026-08-11T12:20:47.680Z", "modified": "2026-08-11T12:20:48.875Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-08-11T12:20:48.875Z" }, "description_available": false, "entity_type": "based-on", "fromId": "16c32f96-ca94-4aef-b469-617aefc010f3", "from_id": "16c32f96-ca94-4aef-b469-617aefc010f3", "from_name": null, "from_type": "Indicator", "id": "b00db9c2-6803-47b8-a474-e026cba22678", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--dc4b503c-bcfa-5fee-bdb6-1b3a6dd5466b", "toId": "51789bec-412a-49aa-9a07-33e97165c424", "to_id": "51789bec-412a-49aa-9a07-33e97165c424", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-08T12:45:20.443Z", "created_at": "2026-08-11T12:21:02.118Z", "modified": "2026-08-11T12:21:02.684Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-08-11T12:21:02.684Z" }, "description_available": false, "entity_type": "based-on", "fromId": "6fa2176b-f0b6-49e9-a5e6-5930951d4d8e", "from_id": "6fa2176b-f0b6-49e9-a5e6-5930951d4d8e", "from_name": null, "from_type": "Indicator", "id": "b4fff0e0-94c4-4bd5-8f86-27c07038e21d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--eba8fe48-52bf-52d8-a65c-b3c4c8c655dd", "toId": "b6959eed-59f4-40b7-9385-10ba827eda7b", "to_id": "b6959eed-59f4-40b7-9385-10ba827eda7b", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-08T12:45:20.360Z", "created_at": "2026-08-11T12:20:36.559Z", "modified": "2026-08-11T12:20:38.234Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-08-11T12:20:38.234Z" }, "description_available": false, "entity_type": "based-on", "fromId": "7568f918-944d-4ad5-8a77-6007a061b949", "from_id": "7568f918-944d-4ad5-8a77-6007a061b949", "from_name": null, "from_type": "Indicator", "id": "bb0e3b63-40e8-44a6-8494-339b6154b84c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--1fc6b819-3d72-568d-8f1a-3f58447531b6", "toId": "906e1606-d589-4526-90f4-fffc23499b7b", "to_id": "906e1606-d589-4526-90f4-fffc23499b7b", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.468Z", "created_at": "2026-09-26T03:39:52.477Z", "modified": "2026-09-26T03:39:52.645Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T03:39:52.645Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5f39b1c8-88d3-485a-b2ee-842a9b086646", "from_id": "5f39b1c8-88d3-485a-b2ee-842a9b086646", "from_name": null, "from_type": "Indicator", "id": "bb98f0e5-d2d8-4a64-bcf7-899e1ab820c7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--6afb4e6c-94dd-5139-acb2-e5a20bd2bf7e", "toId": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_id": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_name": "Storm-3121, Storm-3032", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.281Z", "created_at": "2026-09-26T03:37:04.647Z", "modified": "2026-09-26T03:37:04.861Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T03:37:04.861Z" }, "description_available": false, "entity_type": "based-on", "fromId": "dc88cc5c-a198-4be9-ab3b-521d1942d004", "from_id": "dc88cc5c-a198-4be9-ab3b-521d1942d004", "from_name": null, "from_type": "Indicator", "id": "bee46a93-5a48-4878-8b1c-3d239691c7e6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--fa99ce98-1583-5c1b-a60e-1d0fd16005b5", "toId": "4a039d8d-31d0-4d40-a9a2-44375675cc1d", "to_id": "4a039d8d-31d0-4d40-a9a2-44375675cc1d", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.328Z", "created_at": "2026-09-26T03:37:09.372Z", "modified": "2026-09-26T03:37:09.864Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T03:37:09.864Z" }, "description_available": false, "entity_type": "based-on", "fromId": "ce7926f6-f65c-46a6-a6f0-6e65cb31ee70", "from_id": "ce7926f6-f65c-46a6-a6f0-6e65cb31ee70", "from_name": null, "from_type": "Indicator", "id": "c2d445be-e3a5-43f2-b3f8-b4b1fa02a72b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--8fa5d3ab-934b-5ba5-9816-315a869e64fb", "toId": "84486369-7ff2-478a-bd8d-cb94564bd6a0", "to_id": "84486369-7ff2-478a-bd8d-cb94564bd6a0", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.425Z", "created_at": "2026-09-26T03:39:02.549Z", "modified": "2026-09-26T03:39:02.880Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T03:39:02.880Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1e21e2a4-12cf-4811-979c-11863362d06e", "from_id": "1e21e2a4-12cf-4811-979c-11863362d06e", "from_name": null, "from_type": "Indicator", "id": "d6723fab-cf52-462d-8270-a8ecdc4336e6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--b325e0fb-24e8-5938-9906-d071c9896ad1", "toId": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_id": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_name": "Storm-3121, Storm-3032", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.318Z", "created_at": "2026-09-26T03:37:08.288Z", "modified": "2026-09-26T03:37:08.936Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T03:37:08.936Z" }, "description_available": false, "entity_type": "based-on", "fromId": "28bbc68c-7ae3-45a9-842c-aeadef68c51b", "from_id": "28bbc68c-7ae3-45a9-842c-aeadef68c51b", "from_name": null, "from_type": "Indicator", "id": "e5cf1b77-7c0c-4e9f-b11a-49b595f4f3ba", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--658d2857-b467-5986-af37-7e965077f10a", "toId": "f738b88a-d51d-4f1c-9ef6-d1532d58b2f6", "to_id": "f738b88a-d51d-4f1c-9ef6-d1532d58b2f6", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.460Z", "created_at": "2026-09-26T03:39:44.841Z", "modified": "2026-09-26T03:39:45.080Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T03:39:45.080Z" }, "description_available": false, "entity_type": "indicates", "fromId": "30cdbe8a-ec17-494e-82e3-ee77db932456", "from_id": "30cdbe8a-ec17-494e-82e3-ee77db932456", "from_name": null, "from_type": "Indicator", "id": "f23ea45e-3e73-42f9-b3bd-11389539d7fb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--e7d85a25-f17d-5278-80dc-4a055d70ff4d", "toId": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_id": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_name": "Storm-3121, Storm-3032", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.314Z", "created_at": "2026-09-26T03:37:08.047Z", "modified": "2026-09-26T03:37:08.496Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T03:37:08.496Z" }, "description_available": false, "entity_type": "based-on", "fromId": "87e30152-cae3-47b0-9dd1-7b2db3541b08", "from_id": "87e30152-cae3-47b0-9dd1-7b2db3541b08", "from_name": null, "from_type": "Indicator", "id": "f5c49291-a6ca-4e02-97f9-8c087813dca6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--6004b252-5cee-56b8-a538-24505cf03f08", "toId": "d346995b-fd3b-4117-bdde-2b6d8c23503a", "to_id": "d346995b-fd3b-4117-bdde-2b6d8c23503a", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:52:34.404Z", "created_at": "2026-09-26T03:38:36.880Z", "modified": "2026-09-26T03:38:37.125Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T03:38:37.125Z" }, "description_available": false, "entity_type": "indicates", "fromId": "16c32f96-ca94-4aef-b469-617aefc010f3", "from_id": "16c32f96-ca94-4aef-b469-617aefc010f3", "from_name": null, "from_type": "Indicator", "id": "f7b4aa2b-3c57-4ec1-a476-7903f5d02174", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--7256c7e6-2477-5e8f-937a-f269bba58a83", "toId": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_id": "930ab33a-b360-4aed-adf7-ba5a8868d063", "to_name": "Storm-3121, Storm-3032", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-08T12:45:20.478Z", "created_at": "2026-08-11T12:21:15.847Z", "modified": "2026-08-11T12:21:16.621Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-08-11T12:21:16.621Z" }, "description_available": false, "entity_type": "based-on", "fromId": "86684b55-771b-4a7f-be5a-72448fc8ee3e", "from_id": "86684b55-771b-4a7f-be5a-72448fc8ee3e", "from_name": null, "from_type": "Indicator", "id": "fd202b50-3eda-48ca-aa9e-84ea11809d5d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "standard_id": "relationship--bfeb6983-a248-5644-8459-1651cb33f5d9", "toId": "2ecb7abf-1422-41b6-a34a-1d0e753fc50e", "to_id": "2ecb7abf-1422-41b6-a34a-1d0e753fc50e", "to_name": null, "to_type": "DomainName" } ], "iocs": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "add-passkey[.]com", "description_available": false, "object_id": "16c32f96-ca94-4aef-b469-617aefc010f3", "object_ids": [ "16c32f96-ca94-4aef-b469-617aefc010f3", "51789bec-412a-49aa-9a07-33e97165c424" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "16c32f96-ca94-4aef-b469-617aefc010f3", "valid_from": "2026-08-06T22:15:44.000Z", "valid_until": "2026-11-17T13:10:52.260Z", "validity_status": "active", "value": "add-passkey.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "51789bec-412a-49aa-9a07-33e97165c424", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "add-passkey.com" } ], "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "type": "domain", "valid_from": "2026-08-06T22:15:44.000Z", "valid_until": "2026-11-17T13:10:52.260Z", "validity_status": "active", "value": "add-passkey.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "integratedsso[.]com", "description_available": false, "object_id": "1e21e2a4-12cf-4811-979c-11863362d06e", "object_ids": [ "1e21e2a4-12cf-4811-979c-11863362d06e", "2cd4d099-2beb-4fc9-9f35-549765e69450" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "1e21e2a4-12cf-4811-979c-11863362d06e", "valid_from": "2026-09-09T20:33:04.000Z", "valid_until": "2026-12-21T11:28:12.260Z", "validity_status": "active", "value": "integratedsso.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "2cd4d099-2beb-4fc9-9f35-549765e69450", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "integratedsso.com" } ], "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "type": "domain", "valid_from": "2026-09-09T20:33:04.000Z", "valid_until": "2026-12-21T11:28:12.260Z", "validity_status": "active", "value": "integratedsso.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "keysyncos[.]com", "description_available": false, "object_id": "7568f918-944d-4ad5-8a77-6007a061b949", "object_ids": [ "7568f918-944d-4ad5-8a77-6007a061b949", "906e1606-d589-4526-90f4-fffc23499b7b" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "7568f918-944d-4ad5-8a77-6007a061b949", "valid_from": "2026-08-06T22:15:44.000Z", "valid_until": "2026-11-17T13:10:52.260Z", "validity_status": "active", "value": "keysyncos.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "906e1606-d589-4526-90f4-fffc23499b7b", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "keysyncos.com" } ], "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "type": "domain", "valid_from": "2026-08-06T22:15:44.000Z", "valid_until": "2026-11-17T13:10:52.260Z", "validity_status": "active", "value": "keysyncos.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "myconnectkey[.]com", "description_available": false, "object_id": "9911d2ed-8417-4071-b776-dc5cc40b7622", "object_ids": [ "9911d2ed-8417-4071-b776-dc5cc40b7622", "9da4b2eb-d4e4-46e1-95f1-53e84f7784a7" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "9911d2ed-8417-4071-b776-dc5cc40b7622", "valid_from": "2026-08-06T22:15:44.000Z", "valid_until": "2026-11-17T13:10:52.260Z", "validity_status": "active", "value": "myconnectkey.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "9da4b2eb-d4e4-46e1-95f1-53e84f7784a7", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "myconnectkey.com" } ], "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "type": "domain", "valid_from": "2026-08-06T22:15:44.000Z", "valid_until": "2026-11-17T13:10:52.260Z", "validity_status": "active", "value": "myconnectkey.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "oktasession[.]com", "description_available": false, "object_id": "87e30152-cae3-47b0-9dd1-7b2db3541b08", "object_ids": [ "87e30152-cae3-47b0-9dd1-7b2db3541b08", "d346995b-fd3b-4117-bdde-2b6d8c23503a" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "87e30152-cae3-47b0-9dd1-7b2db3541b08", "valid_from": "2026-09-09T20:33:04.000Z", "valid_until": "2026-12-21T11:28:12.260Z", "validity_status": "active", "value": "oktasession.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "d346995b-fd3b-4117-bdde-2b6d8c23503a", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "oktasession.com" } ], "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "type": "domain", "valid_from": "2026-09-09T20:33:04.000Z", "valid_until": "2026-12-21T11:28:12.260Z", "validity_status": "active", "value": "oktasession.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "oskeyconnect[.]com", "description_available": false, "object_id": "6fa2176b-f0b6-49e9-a5e6-5930951d4d8e", "object_ids": [ "6fa2176b-f0b6-49e9-a5e6-5930951d4d8e", "b6959eed-59f4-40b7-9385-10ba827eda7b" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "6fa2176b-f0b6-49e9-a5e6-5930951d4d8e", "valid_from": "2026-08-06T22:15:44.000Z", "valid_until": "2026-11-17T13:10:52.260Z", "validity_status": "active", "value": "oskeyconnect.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "b6959eed-59f4-40b7-9385-10ba827eda7b", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "oskeyconnect.com" } ], "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "type": "domain", "valid_from": "2026-08-06T22:15:44.000Z", "valid_until": "2026-11-17T13:10:52.260Z", "validity_status": "active", "value": "oskeyconnect.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "oskeyregister[.]com", "description_available": false, "object_id": "4235404a-5fda-48ae-947f-1ac44334008f", "object_ids": [ "4235404a-5fda-48ae-947f-1ac44334008f", "803d0ea5-2641-4412-96f2-ea37ecfe363c" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "4235404a-5fda-48ae-947f-1ac44334008f", "valid_from": "2026-09-09T20:33:04.000Z", "valid_until": "2026-12-21T11:28:12.260Z", "validity_status": "active", "value": "oskeyregister.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "803d0ea5-2641-4412-96f2-ea37ecfe363c", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "oskeyregister.com" } ], "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "type": "domain", "valid_from": "2026-09-09T20:33:04.000Z", "valid_until": "2026-12-21T11:28:12.260Z", "validity_status": "active", "value": "oskeyregister.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "oskeysetup[.]com", "description_available": false, "object_id": "7484b670-951f-40e5-8177-bde2650e80b8", "object_ids": [ "7484b670-951f-40e5-8177-bde2650e80b8", "82733e65-81b1-4f0b-94e6-744f13fcfdf3" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "7484b670-951f-40e5-8177-bde2650e80b8", "valid_from": "2026-09-09T20:33:04.000Z", "valid_until": "2026-12-21T11:28:12.260Z", "validity_status": "active", "value": "oskeysetup.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "82733e65-81b1-4f0b-94e6-744f13fcfdf3", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "oskeysetup.com" } ], "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "type": "domain", "valid_from": "2026-09-09T20:33:04.000Z", "valid_until": "2026-12-21T11:28:12.260Z", "validity_status": "active", "value": "oskeysetup.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "oskeysync[.]com", "description_available": false, "object_id": "47746501-c1e7-4c1f-ae9e-59587b1bc826", "object_ids": [ "47746501-c1e7-4c1f-ae9e-59587b1bc826", "899de763-5741-49b9-8f4a-5bd9f5ea88cf" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "47746501-c1e7-4c1f-ae9e-59587b1bc826", "valid_from": "2026-07-23T15:25:39.000Z", "valid_until": "2026-11-03T06:20:47.260Z", "validity_status": "active", "value": "oskeysync.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "899de763-5741-49b9-8f4a-5bd9f5ea88cf", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "oskeysync.com" } ], "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "type": "domain", "valid_from": "2026-07-23T15:25:39.000Z", "valid_until": "2026-11-03T06:20:47.260Z", "validity_status": "active", "value": "oskeysync.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "passkeyhelpdesk[.]com", "description_available": false, "object_id": "49806b02-1f6b-4bdb-a949-9ba6f3e5b646", "object_ids": [ "4248c030-0706-4e2c-953c-68f6e827c93f", "49806b02-1f6b-4bdb-a949-9ba6f3e5b646" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "49806b02-1f6b-4bdb-a949-9ba6f3e5b646", "valid_from": "2026-08-06T22:15:44.000Z", "valid_until": "2026-11-17T13:10:52.260Z", "validity_status": "active", "value": "passkeyhelpdesk.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "4248c030-0706-4e2c-953c-68f6e827c93f", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "passkeyhelpdesk.com" } ], "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "type": "domain", "valid_from": "2026-08-06T22:15:44.000Z", "valid_until": "2026-11-17T13:10:52.260Z", "validity_status": "active", "value": "passkeyhelpdesk.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "portalsetuphub[.]com", "description_available": false, "object_id": "b48059db-4c72-4e19-a8a9-6adf0f5d6880", "object_ids": [ "b48059db-4c72-4e19-a8a9-6adf0f5d6880", "f22f832f-079d-42d1-8b1f-230246b9e96c" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "b48059db-4c72-4e19-a8a9-6adf0f5d6880", "valid_from": "2026-08-06T22:15:44.000Z", "valid_until": "2026-11-17T13:10:52.260Z", "validity_status": "active", "value": "portalsetuphub.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "f22f832f-079d-42d1-8b1f-230246b9e96c", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "portalsetuphub.com" } ], "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "type": "domain", "valid_from": "2026-08-06T22:15:44.000Z", "valid_until": "2026-11-17T13:10:52.260Z", "validity_status": "active", "value": "portalsetuphub.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "secure-passkey[.]com", "description_available": false, "object_id": "86684b55-771b-4a7f-be5a-72448fc8ee3e", "object_ids": [ "2ecb7abf-1422-41b6-a34a-1d0e753fc50e", "86684b55-771b-4a7f-be5a-72448fc8ee3e" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "86684b55-771b-4a7f-be5a-72448fc8ee3e", "valid_from": "2026-08-06T22:15:44.000Z", "valid_until": "2026-11-17T13:10:52.260Z", "validity_status": "active", "value": "secure-passkey.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "2ecb7abf-1422-41b6-a34a-1d0e753fc50e", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "secure-passkey.com" } ], "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "type": "domain", "valid_from": "2026-08-06T22:15:44.000Z", "valid_until": "2026-11-17T13:10:52.260Z", "validity_status": "active", "value": "secure-passkey.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "setupmypasskey[.]com", "description_available": false, "object_id": "dc88cc5c-a198-4be9-ab3b-521d1942d004", "object_ids": [ "4a039d8d-31d0-4d40-a9a2-44375675cc1d", "dc88cc5c-a198-4be9-ab3b-521d1942d004" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "dc88cc5c-a198-4be9-ab3b-521d1942d004", "valid_from": "2026-09-09T20:33:04.000Z", "valid_until": "2026-12-21T11:28:12.260Z", "validity_status": "active", "value": "setupmypasskey.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "4a039d8d-31d0-4d40-a9a2-44375675cc1d", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "setupmypasskey.com" } ], "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "type": "domain", "valid_from": "2026-09-09T20:33:04.000Z", "valid_until": "2026-12-21T11:28:12.260Z", "validity_status": "active", "value": "setupmypasskey.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "syncmykey[.]com", "description_available": false, "object_id": "28bbc68c-7ae3-45a9-842c-aeadef68c51b", "object_ids": [ "28bbc68c-7ae3-45a9-842c-aeadef68c51b", "f738b88a-d51d-4f1c-9ef6-d1532d58b2f6" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "28bbc68c-7ae3-45a9-842c-aeadef68c51b", "valid_from": "2026-09-09T20:33:04.000Z", "valid_until": "2026-12-21T11:28:12.260Z", "validity_status": "active", "value": "syncmykey.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "f738b88a-d51d-4f1c-9ef6-d1532d58b2f6", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "syncmykey.com" } ], "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "type": "domain", "valid_from": "2026-09-09T20:33:04.000Z", "valid_until": "2026-12-21T11:28:12.260Z", "validity_status": "active", "value": "syncmykey.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "validationsetupac[.]com", "description_available": false, "object_id": "ad48e088-cb9a-475e-8236-51e766e3167e", "object_ids": [ "3eeea9d8-0823-4f9e-b10e-a21e996d3993", "ad48e088-cb9a-475e-8236-51e766e3167e" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "ad48e088-cb9a-475e-8236-51e766e3167e", "valid_from": "2026-09-09T20:33:04.000Z", "valid_until": "2026-12-21T11:28:12.260Z", "validity_status": "active", "value": "validationsetupac.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "3eeea9d8-0823-4f9e-b10e-a21e996d3993", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "validationsetupac.com" } ], "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/", "type": "domain", "valid_from": "2026-09-09T20:33:04.000Z", "valid_until": "2026-12-21T11:28:12.260Z", "validity_status": "active", "value": "validationsetupac.com" } ], "mentioned": [], "mitre": { "associated_repertoire": [], "direct_techniques": [] }, "report_metadata": { "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-09T20:33:03.691Z", "created_at": "2026-09-26T03:39:58.613Z", "modified": "2026-09-26T03:39:59.194Z", "published": "2026-09-09T20:33:03.691Z", "updated_at": "2026-09-26T03:39:59.194Z" }, "description_available": true, "id": "f697900f-3025-40fc-beb3-1e5f07d654a9", "is_inferred": false, "labels": [ "aitm phishing", "cloud compromise", "data exfiltration", "passkey lure", "social engineering" ], "lang": "en", "name": "Passkey-themed social engineering leads to identity and cloud compromise", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "published": "2026-09-09T20:33:03.691Z", "references": [ { "external_id": null, "id": "74710ccf-ca46-4dbd-ab2c-50c3d0205a5f", "source_name": "alien-vault", "url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/" }, { "external_id": "6aa1c27fd351a18fbe0a8219", "id": "b005433d-7b18-4536-a3b9-b4d6c4483f26", "source_name": "alien-vault", "url": "https://otx.alienvault.com/pulse/6aa1c27fd351a18fbe0a8219" } ], "report_types": [ "threat-report" ], "restrict_access": false, "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/" }, "targets": [], "techniques": [], "vulnerabilities": [] }, "report_id": "f697900f-3025-40fc-beb3-1e5f07d654a9", "schema_version": 1, "selected_date": "2026-09-09", "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/" }