# Sophisticated Vishing Campaign Bypasses MFA to Steal Microsoft 365 Credentials and Enroll Attacker Passkeys


A newly documented credential theft campaign is using voice phishing calls, fake passkey enrollment pages, and real-time operator manipulation to compromise Microsoft 365 accounts across six industry sectors. Okta has identified the operation as a high-volume threat requiring immediate organizational attention, particularly for enterprises with lax voice security protocols and insufficient MFA monitoring.


## The Threat


Organizations worldwide are being targeted by a sophisticated vishing campaign (voice phishing) that bypasses Microsoft 365 security controls through a combination of social engineering and technical subterfuge. The threat actors use phone calls to direct victims to fake Microsoft Entra ID login pages, then guide them through a multi-stage authentication process that appears legitimate but ultimately enrolls attacker-controlled passkeys in victim accounts.


According to Okta's threat intelligence team, the campaign has been active since April 2026 and continues to expand. The operation is tracked under multiple identifiers:


  • O-UNC-066 (Okta designation)
  • CL-CRI-1147 (alternative tracking)
  • Pink (threat actor alias)

    • The campaign has demonstrated persistent targeting across a broad set of organizations, with successful account takeovers resulting in data extortion demands. This represents a critical threat vector for organizations that rely on Microsoft 365 for email, collaboration, and identity management.


    ## Background and Context


    ### Targeted Industries


    Okta's analysis identifies the campaign affecting six major industry verticals:


    | Industry | Risk Level | Primary Asset |

    |----------|-----------|---------------|

    | Healthcare | High | Patient data, billing systems, credentials |

    | Technology | High | Intellectual property, customer data |

    | Automotive | Medium-High | Supply chain data, employee credentials |

    | Aviation | Medium-High | Operations, logistics, passenger data |

    | Construction | Medium | Project data, vendor access |

    | Food & Beverage | Medium | Supply chain, operational credentials |


    Healthcare organizations face particularly acute risk given that Microsoft 365 access often includes patient data, electronic health records, and billing systems. The vishing vector specifically targets user psychology rather than system vulnerabilities, making it difficult to defend against through technical controls alone.


    ### Campaign Timeline


    The campaign's April 2026 start date coincides with increased visibility of passkey adoption across enterprise environments. Threat actors appear to have timed their operation to exploit the confusion surrounding new authentication mechanisms—a period when end-user familiarity with passkeys remains low and security awareness training may lag behind technology rollout.


    ### Attacker Infrastructure


    The threat actors have registered multiple domains incorporating the word "passkey," creating the foundation for their phishing infrastructure. These domains are used to host fake Microsoft Entra ID login pages that load legitimate Microsoft branding and content from Microsoft's own content delivery network (CDN)—a technique that bypasses some URL-based security filtering and enhances the pages' appearance of legitimacy.


    ## Technical Details


    ### The Attack Flow


    This campaign is notable for its operator-controlled attack methodology, which represents a significant evolution in phishing kit sophistication:


    1. Initial Contact: Victim receives a voice call claiming to be from Microsoft, informing them that they must register a new passkey for security compliance.


    2. Domain Redirect: Victim is directed to a fake Microsoft Entra ID login page incorporating "passkey" in the domain name.


    3. Credential Harvest: The attacker requests the victim's username, which is used to probe account configuration and identify MFA requirements.


    4. Real-Time MFA Bypass: Rather than automatically harvesting credentials, the operator uses the victim's credentials to log into the actual Microsoft account in real-time, observing what MFA challenge is presented.


    5. Adaptive MFA Display: Based on what the operator observes during their login attempt, the phishing page displays the corresponding MFA challenge to the victim (SMS OTP, TOTP, or push notification).


    6. False Passkey Registration: The victim is presented with a fake passkey registration interface that requests them to save a recovery key—actually a BIP-39 seed phrase controlled by the attacker. This step appears designed primarily as social engineering theater; BIP-39 phrases have no legitimate application in Microsoft Entra authentication.


    7. Attacker Passkey Enrollment: While the victim is distracted with the false recovery key process, the actual attacker enrolls their own passkey in the victim's account through legitimate Microsoft APIs.


    8. Account Takeover: The attacker can now use their passkey to access the victim's account without needing the password or MFA tokens, as passkeys are designed to be phishing-resistant and bypass secondary authentication.


    ### Why This Works


    The attack's effectiveness derives from several factors:


  • User Unfamiliarity: Passkey authentication is still novel for many enterprise users. When presented with an interface that *appears* to be passkey enrollment, users have minimal reference points to identify the deception.

  • Legitimacy Signals: The use of Microsoft's actual CDN content, legitimate branding, and realistic page flow creates high visual authenticity.

  • Real-Time Adaptation: Unlike automated phishing kits, this operator-controlled approach allows the attacker to adapt to different MFA configurations in real-time, dramatically increasing success rates.

  • Voice Authority: The initial vishing call leverages human psychology and the trust people place in phone-based "official" communications.

    • ## Implications for Organizations


    ### Scope of Exposure


    Any organization using Microsoft 365 is theoretically at risk, but the following are most exposed:


  • Organizations without robust voice security controls or caller ID verification
  • Enterprises with inadequate security awareness training on vishing tactics
  • Companies lacking real-time alerting on MFA events or passkey enrollment
  • Organizations that have recently rolled out passkeys without comprehensive user education

    • ### Downstream Impact


    Successful account compromise through this campaign leads to:


  • Email Access: Attackers gain full access to victim inboxes, enabling further social engineering, credential theft from emails, and discovery of sensitive organizational information.

  • Data Exfiltration: Compromised accounts provide access to SharePoint, OneDrive, Teams files, and other cloud storage repositories.

  • Lateral Movement: Compromised credentials can be used to access other systems, particularly those integrated with Microsoft 365 for single sign-on (SSO).

  • Extortion Demands: Okta notes that the campaign is associated with data extortion operations, indicating attackers are likely threatening to sell or publish stolen data.

  • Regulatory Exposure: Healthcare organizations face HIPAA breach notification requirements if patient data is compromised. Other industries may face GDPR, state data privacy law, or industry-specific regulatory exposure.

    • ## Recommendations


    ### Immediate Actions


    Incident Response Teams Should:

  • Search Microsoft 365 audit logs for unexpected passkey enrollment events, particularly those occurring outside normal business hours
  • Review authentication logs for successful logins from unfamiliar IP addresses or geographic locations
  • Query call logs and voicemail systems for suspicious calls referencing passkey registration or account security updates

    • Security Teams Should:

  • Alert users about this specific vishing campaign through authenticated channels only
  • Confirm that security awareness training includes passkey-specific social engineering awareness
  • Audit current passkey deployment for any indicators of compromise

    • ### Medium-Term Hardening


    Technical Controls:

  • Implement passkey enrollment notifications that alert account owners of all successful passkey registrations, with clear instructions to revoke suspicious keys
  • Configure MFA enforcement for all administrative accounts and sensitive data access
  • Enable conditional access policies that flag or block access from unusual locations or devices
  • Implement detection rules that alert on multiple failed authentication attempts followed by successful passkey enrollment

    • Organizational Controls:

  • Conduct security awareness training focused on vishing, with specific emphasis on not sharing authentication credentials over the phone
  • Establish phone verification protocols where employees can independently verify caller identity through official channels
  • Restrict passkey enrollment to specific times and require additional verification steps
  • Implement voice security controls such as STIR/SHAKEN verification and call authentication services

    • User Education:

  • Train users that legitimate Microsoft communications will never ask for credentials over the phone
  • Instruct users that legitimate passkey enrollment will never require sharing BIP-39 seed phrases or recovery codes
  • Emphasize that users should independently navigate to Microsoft Entra ID rather than following links from unsolicited calls or emails

    • ### Detection Strategy


    Organizations should implement monitoring rules that alert on:

  • Passkey enrollment from unfamiliar devices or locations
  • Multiple failed authentication attempts followed by successful passkey enrollment
  • Access from IP addresses inconsistent with user location history
  • Unusual email forwarding rule creation or mailbox delegates added to compromised accounts

    • ## HackWire Analysis


    This campaign represents a troubling convergence of social engineering sophistication and technical precision. What makes O-UNC-066 particularly dangerous isn't any single component—vishing has existed for years, and phishing kits are commoditized—but rather the seamless orchestration of voice fraud with real-time account manipulation.


    The attacker's choice to leverage passkeys—specifically by *mimicking* passkey enrollment while actually compromising accounts—suggests a deep understanding of both enterprise security architecture and user psychology. This isn't opportunistic; this is targeted, deliberately designed to exploit the current moment when passkeys are being deployed but users haven't internalized how they actually work.


    The use of BIP-39 seed phrases is particularly telling. These have no legitimate role in Microsoft Entra, yet the attacker includes them as a distraction tactic—a layer of social theater designed to occupy the victim's attention while the real compromise occurs. This speaks to operators with sophisticated threat modeling capabilities, not script kiddies.


    What's concerning for defenders is the real-time operator control model. Most phishing kits are fire-and-forget: register domain, send email, harvest credentials, move on. This operator sits in the middle of the authentication flow, adapting page content based on what MFA the victim's account actually uses. That requires human analysts monitoring the attacks in real-time—suggesting either significant operational overhead or sufficient volume that the economics justify dedicated staff.


    For healthcare organizations specifically, this campaign is particularly problematic because email compromise cascades rapidly into downstream breaches. A single M365 credential in healthcare often provides access to patient records, billing data, and internal communications that are irresistible to extortionists. The notification-and-wait dynamic of passkey enrollment also creates a window where the attacker maintains access while the organization is still investigating.


    The most critical takeaway: voice-based authentication is not a security control—it's a vulnerability vector. Organizations that treat employee phone calls as authoritative, or that allow employees to authenticate sensitive accounts based solely on a phone call, are operating under security assumptions that this campaign specifically targets. Recovery is possible if organizations act quickly—passkey enrollment is logged, audit trails exist, and forensic recovery is faster than with password-only compromises. But only if you're monitoring for it.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Phishing](https://www.hackwire.news/category/phishing) coverage
  • Cross-reference with [Authentication Security](https://www.hackwire.news/category/authentication-security) and [Threat Intelligence](https://www.hackwire.news/category/threat-intelligence)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)