# Vishing Campaign Exploits Microsoft's New Passkey Feature to Harvest Credentials from 365 Users
A sophisticated social engineering attack is actively targeting Microsoft 365 users across multiple industries, weaponizing Microsoft's newly launched passkey enrollment feature to deceive employees into surrendering their credentials and multi-factor authentication codes. The campaign, attributed to the Pink extortion gang and tracked as O-UNC-066, represents a troubling convergence of real-time operator control and psychological manipulation—turning a security upgrade into an attack surface.
## The Threat
The attack begins with a phone call. A voice claiming to represent the victim's IT department informs the employee that they must immediately enroll a new Microsoft Entra passkey for "security compliance." Under pressure, the targeted user is directed to a phishing URL containing the word "passkey" in the domain name—a subtle legitimacy signal designed to pass casual inspection.
What arrives on the user's screen is not a hallucination or generic credential harvester. The phishing portal mirrors the legitimate Microsoft Entra passkey enrollment interface with near-perfect fidelity, complete with the victim organization's branding. But behind the scenes, a threat actor is actively monitoring and adapting the experience in real time.
According to Okta's threat research, the attacker operates an operator-controlled PHP panel that guides victims through the authentication process with a one-second heartbeat polling mechanism. As the victim enters credentials and multi-factor authentication responses—whether TOTP codes, push notification confirmations, or SMS OTPs—the attacker receives them live and immediately uses them to authenticate to the victim's actual Microsoft 365 account.
The psychological manipulation extends further. After the phishing kit extracts the real credentials, it presents the victim with a fake passkey registration screen, including a bogus BIP-39 recovery seed phrase and a request to confirm one word from it. BIP-39 phrases have no role in legitimate Microsoft Entra enrollment; their inclusion appears designed to create false confidence and distract users who might question the legitimacy of the process.
## Background and Context
The vulnerability exploited here stems from a legitimate security initiative. In May 2026, Microsoft enabled administrators to launch "passkey registration campaigns"—a push toward passwordless authentication that aligns with industry best practices. Passkeys promise superior security compared to traditional passwords, especially against phishing. Microsoft's timing made sense from a security perspective.
The threat actors understood immediately that this feature created both opportunity and cover. A call claiming to be from IT requesting passkey enrollment is far more credible in May 2026 than it would have been in 2025—employees have been primed to expect such requests. The phishing domains themselves contain the word "passkey," lending surface-level legitimacy to the deception.
The campaign has been running since at least April 2026, with evidence that it accelerated following Microsoft's official May announcement. This isn't opportunistic; this is rapid weaponization of a known feature against a predictable user base.
## Technical Details
The sophistication lies in real-time operator control—a departure from traditional phishing kits that work autonomously. Here's how the attack unfolds:
Stage 1: Voice Deception
Stage 2: Credential Harvesting
Stage 3: Psychological Reinforcement
Stage 4: Post-Compromise Activity
The real-time operator control is the critical innovation here. Traditional MITM proxies and autonomous phishing kits cannot adapt to each victim's unique MFA configuration during the session. This kit can. The operator watches the victim's behavior, observes which MFA method is required, and escalates to the attacker-controlled account accordingly—all in seconds.
## The Threat Actors: Pink and The Com
The campaign is attributed to O-UNC-066, a threat actor operating the Pink extortion brand. According to Palo Alto Networks Unit 42, Pink is affiliated with The Com (The Community), a decentralized threat network known for its hybrid extortion and data theft operations.
Pink is relatively young—the group launched its extortion site on May 31, 2026, and immediately began publishing stolen data samples to pressure victims into paying ransom. The group is known for vishing and IT impersonation tactics, but the Entra passkey campaign represents an escalation in sophistication and targeting precision.
The Com itself operates as a membership-based extortion network, sharing infrastructure, tooling, and victim lists among affiliated operators. Pink's participation suggests the passkey campaign may benefit from The Com's broader intelligence-gathering capabilities and victim targeting infrastructure.
## Targeted Industries and Scale
Okta's research indicates O-UNC-066 is targeting organizations across six major sectors:
The breadth of targeting suggests the attacker is conducting broad reconnaissance and opportunity-based attacks rather than focusing on a single vertical. However, the precision of the vishing calls—including victim names and organization-specific branding on phishing portals—indicates careful reconnaissance before each attack.
## Implications for Organizations
This attack represents a fundamental shift in how credential theft operates:
| Traditional Phishing | Entra Passkey Campaign |
|---|---|
| Autonomous kit; user receives static form | Operator-guided in real time; adaptive |
| Success rate dependent on credential validity | Success rate enhanced by operator judgment |
| High volume, low targeting precision | Moderate volume, high targeting precision |
| Victims often suspicious of fake sites | Victims believe they're following security guidance |
| Credential access temporary | Persistent backdoor via registered passkey |
Organizations relying on standard security awareness training ("don't click suspicious links") will find it ineffective here. The attacker is leveraging a legitimate Microsoft feature, the urgency of security compliance, and human trust in phone calls from apparent colleagues. These are not factors training alone can overcome.
The persistence threat is acute: Once the attacker registers a passkey, a password change or MFA reset does not remove their access. They retain a cryptographic credential registered on the account, invisible to the user.
## Recommendations
Immediate Actions:
Medium-Term:
## HackWire Analysis
What makes this campaign particularly dangerous is that it weaponizes user trust in security guidance itself. Employees have been trained for years to respond positively to security upgrade requests—two-factor authentication, password managers, passkeys. The attacker understands that a call claiming to enforce security compliance triggers compliance mindset, not skepticism.
The timing is also instructive. Microsoft's passkey announcement in May created a small window of maximum ignorance: users know passkey enrollment is coming, but few understand what it actually entails or what a legitimate enrollment process looks like. The attacker filled that knowledge gap before the user's organization had time to conduct proper user education.
The real-time operator control adds a layer of sophistication often overlooked in headlines: this is not a phishing kit that works or doesn't work based on automation. An experienced operator, watching the victim's session in real time, can adapt language, urgency, and technical flow to maximize compliance. If the victim hesitates, the operator can add urgency. If the victim references a specific MFA technology they don't understand, the operator can adjust the explanation. This human-in-the-loop approach raises success rates dramatically compared to autonomous phishing.
Defenders should note that the BIP-39 seed phrase inclusion is a tell of operator sophistication—it indicates the attacker has studied legitimate passkey concepts and is using that knowledge to create plausible deniability. Unsophisticated phishers don't bother with details that don't affect credential harvesting.
Organizations in the targeted sectors—particularly healthcare and aviation—should treat this as active threat rather than a generic advisory. If you operate in these verticals and receive any request for credential or MFA-sensitive actions, treat it as a compromise attempt until verified through independent channels.
— HackWire Editorial
## Related Coverage