Vishing actors target Entra passkey enrollment

Since April 2026, the O-UNC-066 (Pink) threat actor has conducted a vishing-enabled phishing campaign that targets Microsoft 365 passkey enrollment: attackers call targeted users, direct them to passkey-themed domains and a phishing kit that mimics Microsoft’s enrollment flow, and attempt to register attacker-controlled passkeys in victims’ accounts. Okta observed targeting across multiple industries (food & beverage, technology, healthcare, automotive, construction, aviation) with a data-extortion motive; the phishing kit does not handle third-party federation and Okta has not observed direct Microsoft account compromises in this report.