The Help Desk That Calls You Is Never the Help Desk

Every piece of security advice written in the last two years says the same thing about passkeys: set them up. They resist phishing in a way passwords never could, they cannot be reused, and there is nothing to type into a fake login box. The advice is correct. We give it too.

On September 9, Microsoft published research on a campaign that read all of that advice and found the soft spot in it. Not the passkey. The appointment to install one.

What happened

Someone calls an employee, or texts them, on their personal phone. They say they are from IT. A passkey, or the multi-factor setup, or single sign-on, needs updating today, and if it does not happen something is going to break. They are calm, they are technically fluent, and they know the employee's name and where they work, because that came off social media before the call.

Then they send a link. The sign-in page at the other end looks exactly right. The domain does not: passkeyhelpdesk[.]com, secure-passkey[.]com, or the company's own name glued onto add-passkey[.]com. We have put the dots in brackets here on purpose, so none of these turn into something you can click by accident. These are registered in the morning through a cheap registrar and abandoned by the weekend, which is a deliberate design choice. A domain nobody has ever seen has no bad reputation to look up.

Microsoft attributes the activity to two groups it tracks as Storm-3121 and Storm-3032, running since May 2026 across multiple organizations.

The part worth carrying around

Here is the turn, and it is the reason this story is worth your time even if you will never work somewhere with an IT department.

Setting up your passkey was never the goal.

While the caller had the victim on the phone walking them through the "update," the attacker registered their own sign-in method on the account. A phone number, an authenticator app, a software token. Microsoft found the fingerprint of it sitting in the audit logs, an authentication method added with no device name and no device token attached to it, which is what it looks like when the thing being registered is not a real device in someone's hand.

After that the attacker does not need to call again. They do not need the password. They do not need the passkey either. They are simply one of the ways into the account now, permanently, until somebody goes and looks at the list and takes them off it. In the cases Microsoft documented, what followed was hours to days of quiet reading: mailboxes, files, whatever the account could reach, collected slowly enough to stay under the alerting thresholds.

Why this shape keeps working

Strip out the vocabulary and this is the same scam that gets aimed at retirees every day, which is not a coincidence.

Somebody contacts you. There is a problem you did not know about. It has a deadline. They are here to help you fix it, and fixing it requires you to do something on a screen while they wait.

The passkey version is aimed at people who are, if anything, more security-aware than average. That is what makes it good. A person who has been told repeatedly to enable strong authentication is primed to cooperate with a call about enabling strong authentication. Their diligence is the lever.

The fake MyChart Medicare kit we wrote about in August works on the same principle from the other end: it targets people who are careful about their health care, using a portal they genuinely use. Different audience, different vocabulary, identical architecture.

What to actually do

Treat inbound contact as the signal, not the content. The question is never whether the caller sounded legitimate. It is who started the conversation. Real IT does not ring your personal phone with a deadline. Neither does your bank, your clinic, or Medicare.

Hang up and call back on a number you already had. Not the number they gave you. Not the one in the text. There is no script that survives you dialing somewhere else, which is exactly why they work so hard to keep you on the line.

Go and look at what can sign in to your accounts. This is the one almost nobody does. Most major services have a page listing the phones, apps, and keys registered to your account. Open it. Anything you do not recognize comes off. If you help manage a parent's accounts, walk through it with them once now, while nothing is wrong and there is no deadline.

For businesses: verify identity through a real process before any help-desk-initiated credential or MFA reset, and review newly registered authentication methods on accounts with unusual sign-ins. That is Microsoft's own guidance, and the second half is what would have caught this one.

Where SAFE Portal fits

We cannot stop the phone from ringing. If somebody talks a person through reading a code out loud, no software on that machine was ever going to be part of the conversation, and we are not going to claim otherwise.

What we cover is the page at the end of the link.

On advisor-managed accounts it does not get one at all.

That last one is the honest answer to this specific attack, and it is worth saying plainly because it inverts the whole thing. The trick depends on an unknown person arriving from outside and being accepted as the helper. The advisor model means the helper was chosen in advance, by you, and is already connected. Nobody new gets to become your IT department over the phone.

Good security advice told everyone to go set up a passkey. Somebody read that and set up an appointment.

SAFE Portal is a password manager and link screener built for people who would rather not have to be experts. It is $1 a month, $5 for a family, and free to try at SAFEPortal.to.