# Sophisticated Vishing Campaign Hijacks Microsoft 365 with Fake Passkey Enrollment


Hackers are exploiting the security community's push toward passkey adoption by deploying a novel phishing scheme that tricks users into enrolling attacker-controlled passkeys on their Microsoft 365 accounts. The campaign, attributed to threat actor O-UNC-066 by identity security firm Okta, combines voice-based social engineering with a sophisticated operator-controlled phishing kit to bypass traditional credential theft protections and gain persistent account access.


## The Threat


A previously tracked threat actor identified as O-UNC-066 has launched targeted campaigns against organizations across multiple critical sectors including food and beverage, technology, healthcare, automotive, construction, and aviation industries. The attackers employ a two-pronged attack strategy: first, they call targeted users impersonating Microsoft security personnel, instructing them that passkey enrollment is required for their account. Then, they guide victims through a convincing phishing interface that captures their credentials and MFA tokens in real-time, allowing an attacker operator to complete passkey enrollment on the victim's legitimate Microsoft account.


The attack is particularly insidious because it weaponizes passkey technology itself—a security mechanism designed to eliminate phishing-resistant attack vectors. Rather than stealing credentials and throwing them away after a single authentication, attackers establish persistent, phishing-resistant access through an enrolled passkey, effectively turning the enhanced security mechanism against enterprise defenders.


"The threat actor registers domains that incorporate the word passkey as part of a voice-enabled phishing ('vishing') scheme," Okta researcher Houssem Eddine Bordjiba explained. "The threat actor then calls targeted users on the phone in an attempt to persuade them that they need to register a new passkey."


## How the Attack Works: A Multi-Stage Invasion


The attack chain unfolds across two distinct phases: credential harvesting and passkey injection.


### Phase 1: Credential Harvesting via Phishing Kit


The attacker initiates contact through a vishing (voice phishing) call, typically claiming to represent Microsoft security teams or IT support. They direct the target to visit a website that appears to be a legitimate Microsoft passkey enrollment portal. In reality, the victim is accessing an operator-controlled PHP panel that replicates Microsoft's enrollment process with remarkable fidelity.


The phishing kit guides victims through the following sequence:


1. Anti-analysis gate — A loading screen performs background checks to detect analysis tools or sandboxes

2. Username prompt — The victim enters their Microsoft account username

3. Password harvest — Credentials are collected via a fake password prompt

4. MFA capture — The kit presents a page matching the victim's actual MFA method (SMS OTP, TOTP, push notification)

5. Backend relay — Captured credentials and MFA tokens are sent in real-time to an operator panel at /backend.php


### Phase 2: Real-Time Passkey Injection


Here's where the attack becomes particularly sophisticated. While the victim sees a "processing" screen on their phishing interface, the attacker operator simultaneously:


  • Enters the harvested credentials into the legitimate Microsoft sign-in page for the target organization's tenant
  • Observes the MFA challenges presented by Microsoft
  • Dynamically adjusts the phishing kit pages in real-time to match those challenges
  • Instructs the victim to complete OTP entry or push notification approval on the spoofed pages
  • Once the victim approves the attacker's session, redirects them to a /passkey/register endpoint that completes the enrollment of the attacker's passkey on the now-compromised account

    • This real-time operator control is critical to the attack's success. Unlike traditional adversary-in-the-middle (AitM) phishing kits that work independently, this panel allows dynamic adaptation to organizational security postures, making detection and blocking significantly more difficult.


    ## Industries and Targeting Strategy


    The campaign appears highly targeted, with Okta reporting activity against organizations in:


  • Food & Beverage — Supply chain and operational continuity risks
  • Technology — High-value intellectual property and customer data
  • Healthcare — Patient records and regulatory compliance breaches
  • Automotive — Design data and manufacturing systems
  • Construction — Project management and resource planning systems
  • Aviation — Safety-critical systems and passenger data

    • The sector diversity suggests either multiple threat actors using the same kit or a sophisticated criminal syndicate with broad targeting capabilities. The choice of industries hints at potential data extortion as a follow-on objective, as Okta notes attackers have announced intentions to carry out extortion attacks following successful account takeovers.


    ## Technical Sophistication and Evasion


    What distinguishes this campaign from typical phishing attacks is the architectural elegance of the real-time relay mechanism. The operator panel receives live MFA challenges from the legitimate Microsoft tenant and dynamically serves matching pages to the victim. This approach offers several advantages to attackers:


  • Adaptive verification — The kit adjusts to each organization's MFA requirements without requiring pre-reconnaissance
  • Live handoff control — Operators can pause, retry, or abandon compromised attempts if detection occurs
  • Passkey-resistant bypass — Once the attacker's passkey is enrolled, they retain access indefinitely, even if the victim changes their password
  • Audit trail obfuscation — The legitimate sign-in originated from the victim's device, potentially masking the attacker's origin

    • The phishing domains themselves typically incorporate the word "passkey" to increase plausibility and evade pattern-based domain filtering.


    ## Implications for Enterprise Security


    This campaign represents a critical inflection point in the evolution of phishing attacks. For years, security leaders have promoted passkey adoption as the antidote to credential-based compromise. Microsoft itself has begun allowing administrators to configure registration campaigns to nudge users toward passkey enrollment during sign-in, aiming to drive adoption at scale.


    The O-UNC-066 campaign demonstrates that the transition to passkey-based authentication creates a window of vulnerability. During the enrollment period—precisely when users are being prompted and encouraged to enroll new credentials—attackers can intercept and redirect that process to enroll their own keys instead.


    If successful, these compromises are particularly damaging because:


  • Persistent access — Passkeys can't be revoked by password changes
  • Difficult detection — Passkey enrollment appears as legitimate activity in audit logs
  • Post-breach access — Even after credential reset, the attacker retains entry
  • Supply chain risk — Compromised accounts in vendor or partner organizations can provide supply chain footholds

    • ## Recommendations for Organizations


    Organizations should implement layered defenses against this attack pattern:


    Immediate Actions:

  • Educate users on passkey enrollment procedures and warn against unsolicited calls requesting enrollment
  • Implement caller ID verification — Establish secure callback procedures for passkey enrollment requests
  • Monitor passkey registration — Flag unusual passkey enrollments during non-business hours or from new devices
  • Disable unsolicited enrollment — Configure Microsoft Entra ID to require explicit admin approval for new passkey registrations, rather than user-initiated enrollment

    • Longer-Term Mitigations:

  • Conditional Access policies — Require MFA for passkey registration attempts and restrict registration to known corporate networks
  • Threat detection — Deploy SIEM rules to detect simultaneous authentication from multiple countries or unusual sign-in patterns preceding passkey enrollment
  • Phishing-resistant authentication alternatives — Consider FIDO2 hardware keys for high-value accounts rather than platform-based passkeys during the adoption transition
  • Vendor coordination — Work with Microsoft on security configurations that minimize passkey enrollment vulnerability windows

    • ---


    ## HackWire Analysis


    This campaign exposes a fundamental tension in the industry's march toward phishing-resistant authentication. For the past two years, security leaders have positioned passkeys as the solution to credential theft and phishing. Microsoft, Apple, and Google have all invested heavily in passkey infrastructure, promoting them as the future of authentication. But the O-UNC-066 campaign reveals that during the critical adoption window—when users are actively enrolling passkeys and organizations are prompting them to do so—the enrollment process itself becomes a social engineering vector.


    What's particularly elegant about this attack is that it doesn't break passkey security; it exploits the *transition* to it. The attacker isn't defeating cryptographic protections—they're hijacking the enrollment mechanism while the victim still has the credentials needed to authorize that enrollment. Once the passkey is enrolled, the attacker has persistent access independent of the victim's password or MFA device.


    This points to a broader pattern: authentication migrations are inherently risky periods. During the shift from passwords to MFA, from SMS to authenticator apps, from passwords to passkeys, there's always a window where the old and new authentication mechanisms coexist. Attackers have learned to exploit these transition periods with remarkable precision. The industry should expect similar vishing campaigns targeting other authentication migrations—particularly around hardware security key enrollment and just-in-time access controls.


    For defenders, the lesson is stark: treat passkey enrollment campaigns with the same vigilance you'd apply to a sensitive financial transaction. Verify requests through out-of-band channels. Restrict enrollment to high-trust networks. Require administrative approval for passkey registrations on sensitive accounts. And crucially, don't assume that upgrading to passkeys eliminates the need for user security training. In fact, it may make training more important, because users must now recognize sophisticated attacks that impersonate the very upgrade process meant to protect them.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Breaches](https://www.hackwire.news/category/breaches) coverage
  • Cross-reference with [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)