Loading story…
A threat actor tracked by Okta as O-UNC-066 and linked to the Pink extortion operation is targeting enterprise Microsoft 365 users with voice phishing calls that impersonate internal security staff and direct victims to enroll a new Microsoft Entra passkey. The campaign, active since April, uses domains containing the word "passkey" and phishing pages designed to closely mimic Microsoft’s legitimate Entra passkey enrollment flow, taking advantage of Microsoft’s newer passkey registration prompts and campaign features introduced for administrators.
Okta said the operation relies on an operator-controlled PHP phishing panel that relays credentials and MFA responses in real time and adapts to the victim’s authentication method, allowing the attacker to authenticate to the victim’s Microsoft account and register a passkey under the attacker’s control. Researchers said the compromises are followed by rapid data theft from SharePoint and OneDrive, with victims observed across the food and beverage, technology, healthcare, automotive, construction, and aviation sectors; Pink has also launched an extortion site to pressure organizations by publishing samples of stolen data.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Okta disclosed that O-UNC-066 uses a panel-controlled phishing kit that mimics Microsoft Entra passkey enrollment, adapts in real time to victims' MFA methods such as SMS OTP, TOTP, and push approval, and uses domains containing the word 'passkey.' The attackers then distract victims with fake passkey and recovery-key steps while enrolling an attacker-controlled passkey on the compromised Microsoft 365 account.
Palo Alto Networks reported that after hijacking Microsoft 365 accounts, the attackers exfiltrate data from SharePoint and OneDrive and then send extortion messages from the compromised account using email and Microsoft Teams. The reporting further tied the fake passkey enrollment campaign to a data-extortion objective.
In May 2026, Microsoft introduced or enabled by default passkey registration nudges for administrators, a feature the vishing campaign appears to exploit by directing victims into fake enrollment flows. The attackers timed their activity around this legitimate passkey rollout.
Since April 2026, the threat actor tracked by Okta as O-UNC-066, also known as Pink, has targeted Microsoft 365 users with voice phishing calls and phishing pages that imitate Microsoft Entra passkey enrollment. The campaign targeted organizations across food and beverage, technology, healthcare, automotive, construction, and aviation sectors.
On 2026-05-31, researchers said the Pink extortion operation launched an extortion site used to pressure victims by publishing samples of stolen data. This tied the vishing activity to a broader extortion operation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecysecurity.news
Open sourcescworld.com
Open sourcesecurityweek.com
Open sourcethehackernews.com
Open sourcehelpnetsecurity.com
Open sourcebleepingcomputer.com
Open sourceokta.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A newly tracked extortion group known as **Pink** is using voice phishing and fake internal help-desk calls to trick employees into entering credentials and MFA codes on attacker-controlled phishing pages. Researchers tracking the activity as `CL-CRI-1147` said the actor appears likely **Com-affiliated** and follows a social-engineering playbook associated with groups such as Lapsus$, Scattered Spider, and ShinyHunters. After account takeover, Pink rapidly accesses Microsoft cloud services including **SharePoint** and **OneDrive**, steals sensitive data, and then uses the compromised accounts to send extortion emails and internal **Microsoft Teams** messages to pressure victims. Investigators said the group has also stood up a leak site and typically gives organizations **72 hours** to respond to extortion demands. The campaign shows repeated infrastructure reuse across victims, with common second-level domains and victim-specific subdomains, and phishing hosting frequently tied to **DDoS-Guard**. Reported indicators include the domains `passkeyadd.com`, `passkeydeploy.com`, and `deploypasskey.com`, along with the IP addresses `185.178.208.153`, `172.93.100.252`, and `96.232.20.66`, giving defenders concrete artifacts for threat hunting and blocking.
Jun 29, 2026
Security researchers reported two active phishing operations that relied on social engineering rather than mass malware spam to compromise organizations and steal high-value data. Proofpoint said the cluster it tracks as **UNK_DeadDrop**, likely aligned with North Korea, targeted developers at nearly 100 organizations in cryptocurrency, finance, technology, and education. The attackers used fake recruitment, code review, and technical assessment lures to push victims to attacker-controlled GitHub and GitLab repositories, where hidden Visual Studio Code tasks and a malicious VSIX extension triggered malware on **macOS, Linux, and Windows**. The campaign stole browser credentials, cryptocurrency wallets, cookies, and keychain or keyring data, while maintaining persistence through the extension and removing repository artifacts to reduce detection. A separate campaign tracked by Palo Alto Networks Unit 42 as **CL-CRI-1147** and publicly associated with the **Pink** extortion group targeted enterprise users through voice phishing and credential theft. Researchers said Pink impersonated internal IT staff to direct employees to phishing pages that captured credentials, MFA codes, and session cookies, enabling access to Microsoft 365 services including **OneDrive** and **SharePoint**. The group then used legitimate Microsoft automation tools to exfiltrate data and sent extortion demands through compromised Microsoft Teams accounts and email, typically giving victims 72 hours to pay. Unit 42 linked Pink to the broader Com cybercriminal ecosystem and noted overlaps with groups such as **Lapsus$**, **Scattered Spider**, and **ShinyHunters**, while Google Threat Intelligence Group assessed it may be a rebrand of the BlackFile operation.
Jul 12, 2026
Researchers and incident responders are warning that attackers are increasingly abusing Microsoft Entra ID's OAuth 2.0 **device code flow** to hijack Microsoft 365 accounts through legitimate sign-in prompts rather than malware or software exploits. In these attacks, victims are tricked via **vishing** or phishing into entering an attacker-supplied code at Microsoft's device login page and approving MFA, which issues the attacker valid access and refresh tokens. Security firms say the technique can provide broad access to services including **Microsoft Graph**, **Exchange Online**, **OneDrive**, and **SharePoint**, and that password resets alone may not fully contain the intrusion because refresh tokens can persist across services. The activity has been tied to data theft and follow-on abuse. ReliaQuest reported that the **Helix** extortion group used device code phishing, MFA abuse, and rogue authenticator registration to access victim Microsoft 365 tenants, enumerate SharePoint, and exfiltrate data before extortion; reported victims include Medtronic, Nissan, NAIC, Kodak, Infinite Campus, and the University of Nottingham. Separate investigations documented attackers signing in from foreign locations, registering multiple devices, creating hidden inbox rules to suppress replies, and using compromised mailboxes to send phishing messages at scale. Microsoft and security researchers recommend blocking or restricting device code authentication with **Conditional Access**, limiting SharePoint and device registration to managed devices, and monitoring Entra ID telemetry for `AuthenticationProtocol` set to device code, unusual travel, mailbox rule changes, and spikes in device registrations.
Jul 23, 2026