Hackers Use Fake Microsoft Entra Passkey Enrollment to Gain Microsoft 365 Access
Summary: A threat actor tracked by Okta as O-UNC-066 has been calling Microsoft 365 users across food and beverage, technology, healthcare, automotive, construction, and aviation, posing as security staff and persuading them to enroll a new Entra passkey through a phishing kit that mimics the Microsoft enrollment process. The kit is an operator-controlled PHP panel that lets the caller adjust pages and notifications in real time to match each victim's MFA requirements, including TOTP, push notification with number matching, and SMS OTP, so the attacker's own passkey is registered against the victim's account.
What's compelling: The control organizations are being pushed to adopt precisely because it resists phishing is the one being used as the lure, and Okta assesses the kit preys on users' lack of familiarity with what a real passkey registration looks like. Okta also notes a data leak site run under the name Pink since April 2026, with Palo Alto Networks Unit 42 tracking the cluster as CL-CRI-1147 and linking it to The Com, the collective that includes Scattered Spider, ShinyHunters, and LAPSUS$.
Read the original at The Hacker News ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026