Okta Tracks Vishing Kit O-UNC-066 Registering Attacker Passkeys in Microsoft Entra ID Since April

The campaign uses domains containing 'passkey' and customized Entra ID login pages that pull legitimate Microsoft CDN assets. Victims are walked through username, password, then MFA prompts in real time while the operator authenticates directly, observes enabled factors, and registers their own passkey. Okta observed the kit requesting BIP-39 recovery phrases as a distraction before the attacker-controlled passkey is added and named benignly. Microsoft notification emails are sent to victims after enrollment, creating a narrow detection window.

Evidence from Okta's O-UNC-066 tracking shows the kit performs anti-analysis checks and avoids federated redirects to capture credentials before any IdP handoff. Unlike automated kits, this operator-in-the-loop approach adapts to SMS, TOTP or push MFA on the fly. Similar real-time vishing patterns appeared in earlier CL-CRI-1147 operations and align with documented tactics in the 2023 FBI-Google Outsider Enterprise disruption.

The attacks exploit low user familiarity with passkey ceremonies and the absence of device-bound system dialogs in the phishing flow. Procurement records and Microsoft tenant telemetry indicate passkey adoption is accelerating in large enterprises without corresponding logging of enrollment source IPs or device attestation. This creates persistent access vectors once the attacker passkey is active.

Next steps include mandatory passkey enrollment alerts routed to security teams rather than end users and contract requirements for phishing-resistant MFA telemetry in new Microsoft 365 licenses. Organizations should audit recent passkey registrations against known-good device fingerprints within the next 30 days.