Vishing Campaign Abuses Entra Passkey Enrollment Flow

Passkeys are widely - and correctly - described as phishing-resistant. A new vishing campaign shows how attackers turn that reputation into a weapon: since April 2026, a threat actor has been calling employees while posing as Microsoft or internal IT staff, then walking them through what looks like a legitimate Microsoft Entra passkey enrollment. At the end of the call, it is the attacker's passkey that is registered on the victim's account.

Okta Threat Intelligence published a detailed analysis of the campaign on 5 July 2026, tracking the actor as O-UNC-066 - the same cluster Palo Alto Networks Unit 42 tracks as CL-CRI-1147. The takeaway for security teams is uncomfortable but clear: the cryptography is not the target. The human enrollment moment is.

How the Campaign Works

The attack starts with a phone call, not an email. The caller claims to be from Microsoft support or the victim's own IT department and explains that the company is rolling out passkeys, upgrading authentication, or fixing an account issue. The victim is directed to a convincing enrollment site - the actor operates passkey-themed domains such as assignpasskey[.]com and deploypasskey[.]com, with per-target subdomains that make the URL look tailored to the victim's employer. The infrastructure is hosted on DDoS-Guard and IQWeb FZ-LLC, according to the Okta Threat Intelligence analysis.

Because the pretext is a security upgrade, the victim's guard is down. They believe they are making their account safer - and the caller patiently guides them through every step, exactly as a real helpdesk would.

Inside the Kit: A Live Operator, Not a Proxy

Technically, the kit is notable for what it is not. It is not a transparent reverse proxy of the kind used in classic adversary-in-the-middle phishing. Instead, it is an operator-controlled PHP panel with a heartbeat that polls roughly every second. A human operator watches the victim's session in near real time and adapts the pages on the fly to whatever multi-factor method the victim actually uses - a TOTP code from an authenticator app, an SMS one-time password, or a push notification with number matching.

Once the operator has captured credentials and satisfied the MFA challenge, the final move is the persistence play: the attacker enrolls their own passkey on the victim's Entra account. From that point on, the attacker no longer needs the victim at all. They hold a durable, phishing-resistant credential of their own - and ironically, the strength of passkeys now works in the attacker's favor, because that registration will survive password resets.

The victim thinks they completed a passkey setup. In reality, they authorized someone else's key onto their account.

Who Is Being Targeted and Why

The campaign is not opportunistic spray-and-pray. Reported targets span food and beverage, technology, healthcare, automotive, construction, and aviation. The motivation is data extortion: once inside a Microsoft 365 tenant, the actors move quickly to exfiltrate data from SharePoint and OneDrive, then pressure victims via a dedicated leak site known as 'Pink', as reported by Help Net Security.

The campaign has drawn broad coverage, including reporting by BleepingComputer, which underlines how quickly this playbook could be adopted by other groups. Voice-first social engineering has already proven itself in high-profile intrusions; combining it with passkey enrollment gives attackers persistence that outlives the phone call.

The Real Lesson: Enrollment Is the Weak Point

None of this means passkeys are broken. A passkey still cannot be phished off a user the way a password or OTP can, and organizations should continue rolling them out. What this campaign demonstrates is that every strong authentication system has a bootstrapping problem: the moment a new credential is registered is the moment an attacker can insert their own.

That has three practical consequences:

• Employees assume enrollment flows are safe precisely because they have been told passkeys are phishing-resistant. The campaign weaponizes the security messaging itself.
• Helpdesk impersonation beats technology. A patient human operator on the phone defeats controls that block automated phishing kits.
• New credential registrations are a detection signal. A passkey enrolled minutes after an MFA challenge, from unfamiliar infrastructure, deserves the same scrutiny as a new inbox rule after a suspicious login.

What This Means for Your Organization

Defending against this campaign is mostly about process and people, with a few technical guardrails:

• Set a hard rule: IT never calls to enroll credentials. Publish it, repeat it, and make it easy to verify. Any unsolicited call about authentication changes should be terminated and called back via a known internal number.
• Communicate passkey rollouts through authenticated channels only - the intranet, signed internal mail, or the MDM portal - and tell employees exactly what a legitimate enrollment looks like, including the real URL.
• Alert on new passkey and authenticator registrations in Entra, especially those closely following an MFA prompt or originating from anonymizing infrastructure. Review and re-verify recent registrations for privileged accounts.
• Restrict enrollment where possible, for example with conditional access policies that only allow credential registration from trusted networks or compliant devices.
• Train for the phone, not just the inbox. Employees who ace email phishing tests can still be talked through a fake enrollment by a friendly voice. Security awareness training should cover vishing pretexts explicitly, and phishing simulation programs - including callback-style scenarios like those in empowsec - should rehearse the verify-then-act reflex until it is automatic.

The campaign is a preview of where credential attacks are heading as passwords fade: attackers will not break the new cryptography, they will socially engineer their way into its setup ceremonies. Organizations that treat enrollment as a security-critical event - and teach employees to treat unexpected 'IT calls' as hostile until verified - take the easy path off the table.

Key Takeaways

• Since April 2026, actor O-UNC-066 (Unit 42: CL-CRI-1147) has used vishing calls posing as Microsoft or IT staff to steer victims through fake Entra passkey enrollment flows.
• The kit is an operator-controlled panel that adapts in real time to the victim's MFA method, then enrolls the attacker's passkey for durable persistence.
• Motivation is data extortion via the 'Pink' leak site, with rapid SharePoint and OneDrive exfiltration across at least six industries.
• Passkeys remain phishing-resistant - the enrollment moment is the weak point, so protect and monitor credential registration events.
• Establish a no-exceptions callback rule for unsolicited IT calls, and extend awareness training and simulations to voice-based pretexts.