Compromised account mass-sending passkey-themed Teams lures

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•1

Detects a single user account sending an unusually high volume of Microsoft Teams messages containing themes related to passkey, SSO enrollment, or security updates. This behavior is indicative of a compromised internal account being leveraged to propagate social engineering lures to other employees.