This campaign involves sophisticated phone-based social engineering (vishing) combined with operator-controlled phishing kits that impersonate Microsoft 365 passkey enrollment. Attackers register domains containing 'passkey' and call victims to convince them to enroll new passkeys. The phishing infrastructure supports real-time polling and adapts to MFA methods including TOTP, push notifications, and SMS OTP. While victims complete the enrollment, attackers simultaneously register their own passkeys to gain account access. The campaign leverages legitimate Microsoft passkey campaigns as a pretext and targets organizations across diverse sectors. The attackers' primary objective is data extortion through the Pink data leak site. The infrastructure is hosted on DDoS-Guard and IQWeb FZ-LLC.

Successful exploitation allows attackers to bypass multi-factor authentication by registering their own passkeys on victim accounts, potentially leading to unauthorized access to Microsoft 365 accounts. This can result in data theft and subsequent extortion via the Pink data leak site. The campaign affects organizations in multiple industries, increasing the risk of sensitive data compromise.

No official patch or fix applies as this is a social engineering campaign. Organizations should educate users about vishing threats and the risks of unsolicited calls requesting passkey enrollment. Verification of enrollment requests through official channels is recommended. Monitoring for suspicious domain registrations containing 'passkey' and blocking known phishing infrastructure may help reduce exposure. Since this is not a software vulnerability, technical patching is not applicable.