Pink Vishing Campaign Abuses Entra Passkey Enrollment to Hijack Microsoft 365 Accounts

A threat actor tracked by Okta as O-UNC-066 and linked to the Pink extortion operation is targeting enterprise Microsoft 365 users with voice phishing calls that impersonate internal security staff and direct victims to enroll a new Microsoft Entra passkey. The campaign, active since April, uses domains containing the word "passkey" and phishing pages designed to closely mimic Microsoft’s legitimate Entra passkey enrollment flow, taking advantage of Microsoft’s newer passkey registration prompts and campaign features introduced for administrators.

Okta said the operation relies on an operator-controlled PHP phishing panel that relays credentials and MFA responses in real time and adapts to the victim’s authentication method, allowing the attacker to authenticate to the victim’s Microsoft account and register a passkey under the attacker’s control. Researchers said the compromises are followed by rapid data theft from SharePoint and OneDrive, with victims observed across the food and beverage, technology, healthcare, automotive, construction, and aviation sectors; Pink has also launched an extortion site to pressure organizations by publishing samples of stolen data.