Hackers Use Fake Microsoft Entra Passkey Enrollment to Gain Microsoft 365 Access

1. Executive summary

A threat actor tracked by Okta as "O-UNC-066" is conducting voice-phishing (vishing) attacks against Microsoft 365 users across multiple sectors, using fake security calls to trick employees into enrolling a new Microsoft Entra passkey. The attacker-controlled phishing kit — a real-time PHP panel — harvests credentials and MFA tokens, then registers the attacker's own passkey against the victim's Microsoft account, granting persistent unauthorized access for data extortion. Attribution to O-UNC-066 is unconfirmed (no MITRE ATT&CK profile exists for this actor), and the alias "Pink cyber extortion crew" is single-sourced via Help Net Security. EMEA financial services organizations relying on Microsoft 365 and Entra ID are directly exposed to account takeover and data exfiltration via this identity-bound attack chain.

2. Regulatory framing

3. Technical analysis & attack chain

Attack chain (confirmed steps from Okta reporting)

1. Domain registration: The threat actor registers domains incorporating the word "passkey" as part of the vishing pretext.
2. Vishing call: The attacker calls the target user by phone, posing as IT/security staff, and persuades them that they need to register a new passkey.
3. Phishing kit — gate page: The victim is directed to the phishing kit at /gate, which displays a loading icon while performing anti-analysis checks in the background.
4. Phishing kit — identify page: The victim is presented with /identify, requesting their username.
5. Phishing kit — password page: The victim is presented with /password, challenging them for their password.
6. Credential exfiltration: Harvested credentials are sent in a POST request to an operator panel at /backend.php.
7. Operator relay: The phishing kit operator (likely a different individual from the caller) enters the stolen credentials on the legitimate Microsoft sign-in page for the targeted tenant.
8. MFA challenge relay: The victim sees a /processing loading page while the operator observes the MFA challenge presented by Microsoft. The kit then presents the appropriate page to the victim: - /submit-otp — for SMS-based OTP challenges - /submit-authenticator — for TOTP challenges - /approve-authenticator — for push MFA challenges (including number matching)
9. OTP exfiltration: The captured OTP/token is sent in a POST request to /backend.php.
10. Passkey enrollment pretext: The victim is redirected to /passkey/register, instructing them to create a passkey. A Microsoft-branded /passkey page prompts the user to save a recovery key for confirming the passkey.
11. Attacker passkey registration: The attacker registers their own passkey against the victim's Microsoft account, granting persistent unauthorized access.
12. Follow-on activity: The attacker uses the compromised account for data access and extortion.

Technical specifics

• Phishing kit architecture: Unlike adversary-in-the-middle (AitM) toolkits that transparently proxy traffic, this kit is an operator-controlled PHP panel. The operator adapts the user experience in real-time to each victim's MFA requirements (TOTP, push notification with number matching, SMS OTP). The caller controls and adjusts which phishing pages and notifications the victim sees during the live session.
• Kit endpoints (confirmed): /gate, /identify, /password, /processing, /submit-otp, /submit-authenticator, /approve-authenticator, /passkey/register, /passkey, /backend.php.
• Credential/OTP exfiltration path: POST requests to /backend.php.
• Targeted sectors: Food and beverage, technology, healthcare, automotive, construction, and aviation.
• Objective: Data extortion (not ransomware — no encryption component has been reported).
• Identity provider scope: Okta states there is no indication the kit redirects users to third-party identity providers like Okta; the focus is Microsoft Entra ID / Microsoft 365.

Attribution and confidence caveats

• Actor "O-UNC-066" is tracked by Okta but has no MITRE ATT&CK profile — attribution is unconfirmed.
• The name "Pink cyber extortion crew" appears only in Help Net Security's reporting (single-sourced; verify before enforcement).
• No CVE, CVSS score, or CISA-KEV entry is associated with this activity — this is a social-engineering and phishing-kit campaign, not a product vulnerability exploitation.

4. Mitigation & containment

P1 — Within 24 hours

• Audit Entra passkey registrations: Review all recently enrolled passkeys in Microsoft Entra ID for all users. Investigate any passkey registered from unfamiliar devices, IP addresses, or geographies. Remove any unrecognised passkeys immediately.
• Microsoft Graph API: GET /users/{id}/authentication/passkeyMethods (or equivalent under /authentication/) to enumerate registered passkeys.
• Hunt for phishing domains: Search DNS logs, email security gateway logs, and proxy logs for domains containing the string "passkey" that are not legitimate Microsoft domains. Block identified domains at the web proxy and DNS resolver levels.
• Review sign-in logs: Query Microsoft Entra sign-in logs for suspicious interactive sign-ins followed by passkey registration events, particularly from new device IDs or unexpected locations.
• Alert on /backend.php traffic: Configure proxy/IDS to flag any outbound POST requests to URIs ending in /backend.php on non-corporate domains, especially in combination with Microsoft 365 login pretexts.

P2 — Within 72 hours

• Conditional Access hardening: Enforce Conditional Access policies requiring compliant (Intune-managed) devices for Microsoft 365 authentication. Restrict passkey registration to compliant devices only.
• MFA fatigue / push mitigation: If using Microsoft Authenticator push notifications, ensure number matching is enforced (it is by default for Microsoft Authenticator). Train users to deny unexpected push approvals.
• User awareness: Issue a targeted advisory to all staff warning of vishing calls claiming to be from IT requesting passkey enrollment. Legitimate passkey enrollment campaigns originate from Microsoft's native registration flow, not from a third-party website.
• Review passkey registration policies: If administrators have configured Microsoft Entra registration campaigns to nudge users to register passkeys during sign-in, assess whether to pause or tighten these campaigns until the threat subsides, or ensure users can distinguish legitimate Microsoft-native prompts from phishing pages.

P3 — Within 7 days

• Phishing-resistant MFA audit: Ensure that all privileged accounts (Global Admin, Privileged Role Administrator, etc.) use hardware security keys (FIDO2) enrolled through verified Microsoft-native flows only. Audit and revoke any software-based passkeys on admin accounts that cannot be verified as user-enrolled.
• Identity protection policies: Enable Microsoft Entra Identity Protection risk-based policies to block or require additional verification for sign-ins from anomalous locations or unfamiliar devices.
• Tabletop exercise: Incorporate this vishing-to-passkey-enrollment scenario into the next incident response tabletop, focusing on the identity-provider compromise path and rapid passkey revocation procedures.

5. Indicators of compromise

No indicators of compromise available in the source material.

The sources describe the phishing kit's URL paths and architecture in detail but do not provide specific domain names, IP addresses, file hashes, or other traditional IOCs. The URL paths below are endpoint patterns, not resolvable indicators.

Behavioural indicators (from source material)

urlpath  /gate
urlpath  /identify
urlpath  /password
urlpath  /processing
urlpath  /submit-otp
urlpath  /submit-authenticator
urlpath  /approve-authenticator
urlpath  /passkey/register
urlpath  /passkey
urlpath  /backend.php
domainpattern  passkey

6. Detection

rule O_UNC_066_Entra_Passkey_Phishing_Kit {
    meta:
        author = "Adverse Trace"
        date = "2026-07-10"
        reference = "https://thehackernews.com/2026/07/hackers-use-fake-microsoft-entra.html"
        description = "Detects PHP phishing kit targeting Microsoft Entra passkey enrollment — based on known kit endpoint paths and backend exfiltration endpoint"
    strings:
        $gate = "/gate" ascii
        $identify = "/identify" ascii
        $password = "/password" ascii
        $processing = "/processing" ascii
        $submit_otp = "/submit-otp" ascii
        $submit_auth = "/submit-authenticator" ascii
        $approve_auth = "/approve-authenticator" ascii
        $passkey_reg = "/passkey/register" ascii
        $passkey = "/passkey" ascii
        $backend = "/backend.php" ascii
    condition:
        4 of them
}

title: Microsoft Entra Passkey Phishing Kit — Suspicious URL Paths Accessed
id: 7a3c1f2e-9b4d-4e8a-a6f1-0c2d3e4f5a6b
status: experimental
description: >
    Detects access to URL paths associated with the O-UNC-066 Microsoft Entra passkey
    enrollment phishing kit. These paths (/gate, /identify, /password, /submit-otp,
    /submit-authenticator, /approve-authenticator, /passkey/register, /backend.php)
    are not part of legitimate Microsoft Entra ID login flows.
references:

    - https://thehackernews.com/2026/07/hackers-use-fake-microsoft-entra.html
    - https://www.bleepingcomputer.com/news/security/entra-passkey-enrollment-vishing-targets-microsoft-365-users/
author: Adverse Trace
date: 2026/07/10
tags:

    - attack.credential_access
    - attack.phishing
    - attack.t1566
logsource:
    product: proxy
    category: webserver
detection:
    selection_uri:
        c-uri|contains:

            - "/gate"
            - "/identify"
            - "/password"
            - "/processing"
            - "/submit-otp"
            - "/submit-authenticator"
            - "/approve-authenticator"
            - "/passkey/register"
            - "/passkey"
            - "/backend.php"
    filter_legitimate_microsoft:
        c-uri|contains:

            - "login.microsoftonline.com"
            - "login.microsoft.com"
            - "entra.microsoft.com"
    condition: selection_uri and not filter_legitimate_microsoft
falsepositives:

    - Legitimate applications using similar URL path structures (unlikely in combination)
level: high

title: Microsoft Entra — Passkey Registered from New or Unfamiliar Device
id: 8b4d2g3f-0c5e-4f9b-b7a2-1d3e4f5a6b7c
status: experimental
description: >
    Detects a passkey registration event in Microsoft Entra ID from a device or
    location not previously associated with the user, which may indicate
    attacker-initiated passkey enrollment following a vishing attack.
references:

    - https://thehackernews.com/2026/07/hackers-use-fake-microsoft-entra.html
author: Adverse Trace
date: 2026/07/10
tags:

    - attack.persistence
    - attack.t1098
    - attack.account_manipulation
logsource:
    product: azure
    service: auditlogs
detection:
    selection_passkey_reg:
        operationName|contains:

            - "passkey"
            - "Passkey"
        operationName|contains:

            - "register"
            - "Register"
            - "add"
            - "Add"
            - "create"
            - "Create"
    filter_known_device:
        deviceDetail_deviceId|contains: "<known_device_ids>"
    condition: selection_passkey_reg and not filter_known_device
falsepositives:

    - Legitimate user enrolling a passkey on a new device
level: medium

7. Sources

• The Hacker News — "Hackers Use Fake Microsoft Entra Passkey Enrollment to Gain Microsoft 365 Access" — https://thehackernews.com/2026/07/hackers-use-fake-microsoft-entra.html — 2026-07-10
• BleepingComputer — "Entra passkey enrollment vishing targets Microsoft 365 users" — https://www.bleepingcomputer.com/news/security/entra-passkey-enrollment-vishing-targets-microsoft-365-users/ — 2026-07
• Help Net Security — "Extortion crew hijacks Microsoft 365 accounts via fake passkey setup" — https://www.helpnetsecurity.com/2026/07/09/microsoft-365-fake-passkey-setup-enrollment/ — 2026-07-09
• SecurityWeek — "Okta Warns of Vishing Attacks Targeting Microsoft 365 Customers" — https://www.securityweek.com/okta-warns-of-vishing-attacks-targeting-microsoft-365-customers/ — 2026-07

8. Adverse Trace position

This is a high-severity identity-focused campaign that directly targets the Microsoft Entra passkey enrollment process — a mechanism organisations are actively adopting as a phishing-resistant MFA upgrade. The attack chain is technically sound: the operator-controlled PHP panel bypasses traditional AitM detection by relaying credentials and MFA challenges manually rather than proxying traffic, and the end result is a persistent attacker-controlled passkey that survives password resets and MFA re-enrollment. Attribution to O-UNC-066 is unconfirmed (no MITRE profile); the "Pink cyber extortion crew" label is single-sourced to Help Net Security and should be verified before use in enforcement actions. No CVE or product vulnerability is in scope — this is purely social engineering combined with a custom phishing kit. EMEA financial services clients should immediately audit Entra passkey registrations, hunt for "passkey"-themed domains in proxy/DNS logs, and warn staff about vishing calls requesting passkey enrollment. Adverse Trace will continue monitoring for domain IOCs and kit variants as Okta's research is further disseminated.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.