This threat involves a vishing (voice phishing) campaign tracked as O-UNC-066, targeting Microsoft 365 users across various sectors. Attackers call victims, directing them to phishing sites that closely replicate Microsoft Entra ID passkey registration pages. The phishing kit is operator-controlled and dynamically adapts to the victim's MFA setup, requesting credentials and MFA tokens in near real-time. The attacker enrolls their own passkey on the victim’s account, potentially gaining persistent access. The phishing pages use legitimate Microsoft branding and content delivery networks to increase credibility. The campaign exploits user unfamiliarity with passkey authentication, using BIP-39 seed phrases as a distraction while attacker-controlled passkeys are registered. Victims receive legitimate Microsoft emails notifying them of new passkey registrations, which may appear benign to the user. The campaign has been active since April and targets automotive, aviation, construction, food and beverage, healthcare, and technology sectors.

Successful exploitation can lead to unauthorized access to Microsoft 365 accounts despite MFA protections, as attackers enroll their own passkeys and bypass MFA by interacting with victims in real time. This access can be used for data extortion and potentially other malicious activities within compromised organizations. The attack undermines trust in passkey authentication notifications by enrolling attacker-controlled passkeys that appear legitimate to victims.

No official patch or fix applies as this is a social engineering and phishing attack. Organizations should educate users about the risks of unsolicited calls requesting authentication actions and the proper process for passkey enrollment. Users should be trained to verify requests independently through official channels and be cautious of unexpected MFA prompts or passkey registration notifications. Monitoring for unusual passkey registrations and suspicious account activity within Microsoft 365 environments is recommended. Since this is a phishing campaign, technical controls like anti-phishing tools and call screening may help reduce exposure.