Vishing Actors Register Attacker-Controlled Entra Passkeys in Live M365 Sessions

The kit sequences /gate anti-analysis checks, /identify username harvest, /password capture, then backend.php forwarding to the operator who logs into the legitimate tenant. Depending on observed MFA type it surfaces /submit-otp, /submit-authenticator or /approve-authenticator pages before pivoting to /passkey/register. This flow lets a remote caller adjust pages in real time rather than relying on static AitM proxies. Microsoft's concurrent administrator-driven passkey registration campaigns create plausible pretext for the call. The same enrollment surface that organizations are now pushing at scale is being abused to bind attacker hardware keys, granting phishing-resistant access that survives password resets. Evidence of operator-controlled PHP panels and sector-specific targeting matches earlier vishing patterns seen in 2023-2024 BEC campaigns that pivoted from credential theft to session hijacking. No third-party IdP redirection has been observed, keeping the attack inside native Entra flows. Data-extortion follow-on is the documented next stage once persistent access is achieved. Defenders should audit recent passkey registrations against known devices and monitor for anomalous Entra ID sign-ins from previously unseen FIDO2 authenticators.