# Vishing Campaign Exploits Microsoft's New Passkey Feature to Harvest Credentials from 365 Users


A sophisticated social engineering attack is actively targeting Microsoft 365 users across multiple industries, weaponizing Microsoft's newly launched passkey enrollment feature to deceive employees into surrendering their credentials and multi-factor authentication codes. The campaign, attributed to the Pink extortion gang and tracked as O-UNC-066, represents a troubling convergence of real-time operator control and psychological manipulation—turning a security upgrade into an attack surface.


## The Threat


The attack begins with a phone call. A voice claiming to represent the victim's IT department informs the employee that they must immediately enroll a new Microsoft Entra passkey for "security compliance." Under pressure, the targeted user is directed to a phishing URL containing the word "passkey" in the domain name—a subtle legitimacy signal designed to pass casual inspection.


What arrives on the user's screen is not a hallucination or generic credential harvester. The phishing portal mirrors the legitimate Microsoft Entra passkey enrollment interface with near-perfect fidelity, complete with the victim organization's branding. But behind the scenes, a threat actor is actively monitoring and adapting the experience in real time.


According to Okta's threat research, the attacker operates an operator-controlled PHP panel that guides victims through the authentication process with a one-second heartbeat polling mechanism. As the victim enters credentials and multi-factor authentication responses—whether TOTP codes, push notification confirmations, or SMS OTPs—the attacker receives them live and immediately uses them to authenticate to the victim's actual Microsoft 365 account.


The psychological manipulation extends further. After the phishing kit extracts the real credentials, it presents the victim with a fake passkey registration screen, including a bogus BIP-39 recovery seed phrase and a request to confirm one word from it. BIP-39 phrases have no role in legitimate Microsoft Entra enrollment; their inclusion appears designed to create false confidence and distract users who might question the legitimacy of the process.


## Background and Context


The vulnerability exploited here stems from a legitimate security initiative. In May 2026, Microsoft enabled administrators to launch "passkey registration campaigns"—a push toward passwordless authentication that aligns with industry best practices. Passkeys promise superior security compared to traditional passwords, especially against phishing. Microsoft's timing made sense from a security perspective.


The threat actors understood immediately that this feature created both opportunity and cover. A call claiming to be from IT requesting passkey enrollment is far more credible in May 2026 than it would have been in 2025—employees have been primed to expect such requests. The phishing domains themselves contain the word "passkey," lending surface-level legitimacy to the deception.


The campaign has been running since at least April 2026, with evidence that it accelerated following Microsoft's official May announcement. This isn't opportunistic; this is rapid weaponization of a known feature against a predictable user base.


## Technical Details


The sophistication lies in real-time operator control—a departure from traditional phishing kits that work autonomously. Here's how the attack unfolds:


Stage 1: Voice Deception

  • Attacker calls targeted user claiming to represent IT/security team
  • Creates urgency around passkey enrollment compliance
  • Directs victim to attacker-controlled phishing domain

  • Stage 2: Credential Harvesting

  • Victim enters username and password into convincing portal
  • Operator receives credentials live via heartbeat polling (1-second intervals)
  • Operator immediately uses stolen credentials to authenticate to real Microsoft account
  • If MFA is required, victim is prompted to enter code (TOTP, SMS, push confirmation)
  • Operator receives MFA response in real time and relays it to Microsoft's servers

  • Stage 3: Psychological Reinforcement

  • Phishing kit generates fake passkey enrollment screen
  • Fake BIP-39 seed phrase presented as confirmation mechanism
  • Victim believes they've successfully enrolled a security key
  • Victim has actually handed complete account access to attacker

  • Stage 4: Post-Compromise Activity

  • Attacker registers an actual passkey under their control on the victim's account
  • This persistent backdoor survives password changes and MFA resets
  • Attacker gains access to SharePoint and OneDrive
  • Data exfiltration begins within hours

  • The real-time operator control is the critical innovation here. Traditional MITM proxies and autonomous phishing kits cannot adapt to each victim's unique MFA configuration during the session. This kit can. The operator watches the victim's behavior, observes which MFA method is required, and escalates to the attacker-controlled account accordingly—all in seconds.


    ## The Threat Actors: Pink and The Com


    The campaign is attributed to O-UNC-066, a threat actor operating the Pink extortion brand. According to Palo Alto Networks Unit 42, Pink is affiliated with The Com (The Community), a decentralized threat network known for its hybrid extortion and data theft operations.


    Pink is relatively young—the group launched its extortion site on May 31, 2026, and immediately began publishing stolen data samples to pressure victims into paying ransom. The group is known for vishing and IT impersonation tactics, but the Entra passkey campaign represents an escalation in sophistication and targeting precision.


    The Com itself operates as a membership-based extortion network, sharing infrastructure, tooling, and victim lists among affiliated operators. Pink's participation suggests the passkey campaign may benefit from The Com's broader intelligence-gathering capabilities and victim targeting infrastructure.


    ## Targeted Industries and Scale


    Okta's research indicates O-UNC-066 is targeting organizations across six major sectors:


  • Food and Beverage
  • Technology
  • Healthcare
  • Automotive
  • Construction
  • Aviation

  • The breadth of targeting suggests the attacker is conducting broad reconnaissance and opportunity-based attacks rather than focusing on a single vertical. However, the precision of the vishing calls—including victim names and organization-specific branding on phishing portals—indicates careful reconnaissance before each attack.


    ## Implications for Organizations


    This attack represents a fundamental shift in how credential theft operates:


    | Traditional Phishing | Entra Passkey Campaign |

    |---|---|

    | Autonomous kit; user receives static form | Operator-guided in real time; adaptive |

    | Success rate dependent on credential validity | Success rate enhanced by operator judgment |

    | High volume, low targeting precision | Moderate volume, high targeting precision |

    | Victims often suspicious of fake sites | Victims believe they're following security guidance |

    | Credential access temporary | Persistent backdoor via registered passkey |


    Organizations relying on standard security awareness training ("don't click suspicious links") will find it ineffective here. The attacker is leveraging a legitimate Microsoft feature, the urgency of security compliance, and human trust in phone calls from apparent colleagues. These are not factors training alone can overcome.


    The persistence threat is acute: Once the attacker registers a passkey, a password change or MFA reset does not remove their access. They retain a cryptographic credential registered on the account, invisible to the user.


    ## Recommendations


    Immediate Actions:


  • Establish helpdesk identity verification procedures that do not rely on callback numbers or email addresses (which may be spoofed). Require employees to independently verify requests for credential-sensitive actions using directory lookups or in-person confirmation.
  • Isolate MFA from the authentication flow when possible. If an employee receives an unsolicited call requesting security actions, any legitimate IT team should handle MFA verification through a separate channel the employee initiates.
  • Audit registered passkeys on all critical accounts. Check for unexpected or unfamiliar passkeys in the Azure portal under "Security" → "Passwordless sign-in."
  • Block passkey registration from unexpected locations. Use Conditional Access policies to restrict passkey enrollment to known corporate networks or geographies.
  • Monitor for impossible travel. Passkey registration followed by account access from a geographically inconsistent location is a strong signal of compromise.

  • Medium-Term:


  • Implement step-up authentication for sensitive operations like SharePoint/OneDrive access. Even if credentials and MFA are compromised, an additional verification step for data access creates friction for attackers.
  • Deploy account monitoring for anomalous activity, particularly after passkey registration. Unusual file access patterns, bulk downloads, or forwarding rule creation should trigger immediate review.
  • Conduct red team exercises simulating this exact attack to identify employees most susceptible to vishing and target them for additional training.

  • ## HackWire Analysis


    What makes this campaign particularly dangerous is that it weaponizes user trust in security guidance itself. Employees have been trained for years to respond positively to security upgrade requests—two-factor authentication, password managers, passkeys. The attacker understands that a call claiming to enforce security compliance triggers compliance mindset, not skepticism.


    The timing is also instructive. Microsoft's passkey announcement in May created a small window of maximum ignorance: users know passkey enrollment is coming, but few understand what it actually entails or what a legitimate enrollment process looks like. The attacker filled that knowledge gap before the user's organization had time to conduct proper user education.


    The real-time operator control adds a layer of sophistication often overlooked in headlines: this is not a phishing kit that works or doesn't work based on automation. An experienced operator, watching the victim's session in real time, can adapt language, urgency, and technical flow to maximize compliance. If the victim hesitates, the operator can add urgency. If the victim references a specific MFA technology they don't understand, the operator can adjust the explanation. This human-in-the-loop approach raises success rates dramatically compared to autonomous phishing.


    Defenders should note that the BIP-39 seed phrase inclusion is a tell of operator sophistication—it indicates the attacker has studied legitimate passkey concepts and is using that knowledge to create plausible deniability. Unsophisticated phishers don't bother with details that don't affect credential harvesting.


    Organizations in the targeted sectors—particularly healthcare and aviation—should treat this as active threat rather than a generic advisory. If you operate in these verticals and receive any request for credential or MFA-sensitive actions, treat it as a compromise attempt until verified through independent channels.


    HackWire Editorial


    ## Related Coverage


  • Read more in our [Breaches](https://www.hackwire.news/category/breaches) coverage
  • Cross-reference with [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)