Hackers Use Fake Microsoft Entra Passkey Enrollment to Gain Microsoft 365 Access

Okta warns of an active vishing campaign (actor O-UNC-066) targeting multiple industries where victims are socially engineered to follow a Microsoft-branded passkey enrollment phishing flow; an operator-controlled PHP panel harvests credentials and MFA responses in near real-time, registers attacker-controlled passkeys on compromised Microsoft 365 accounts, and facilitates account takeover and data extortion. The activity is linked to a public data leak site (Pink) and tracked by other firms as part of a decentralized cybercrime collective.