Entra passkey enrollment vishing targets Microsoft 365 users
Pink extortion gang targets Microsoft 365 users with Entra passkey enrollment vishing campaigns.
A threat actor tracked as O-UNC-066 (Pink extortion gang) has been running a vishing campaign since April targeting Microsoft 365 users across multiple sectors. The attack exploits Microsoft's May 2026 passkey registration campaign feature, using phone calls and phishing kits that mimic legitimate Entra enrollment portals to harvest credentials and MFA responses. Once compromised, attackers register passkeys under their control and rapidly exfiltrate data from SharePoint and OneDrive before demanding ransom.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe O-UNC-066 threat actor exploited user unfamiliarity with Microsoft's new passkey registration process by impersonating legitimate Entra enrollment portals via phone and phishing kits, tricking users into surrendering credentials and MFA tokens. Because passkeys are designed as strong authenticators, once an attacker registers one under their control they effectively achieve persistent, phishing-resistant access to the victim's account — turning a security feature into a persistence mechanism. The rapid follow-on exfiltration from SharePoint and OneDrive before a ransom demand highlights how a single social-engineering success can cascade into a full data-breach event. This attack matters because it weaponizes a security improvement rollout itself, meaning organizations that fail to train users on legitimate enrollment workflows inadvertently create a new attack surface during the transition period.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Pink