[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fg6oKilCW5YlfBjANLf_DYjX2QcOUuOvVLREnMtIGaz0":3},{"article":4,"iocs":53,"watch_terms":56,"solutions":57,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"030f9037-1af3-4209-adb4-549db60c9786","Entra passkey enrollment vishing targets Microsoft 365 users","entra-passkey-enrollment-vishing-targets-microsoft-365-users-26b747","A threat actor has been targeting organizations across multiple sectors with voice-based fake security requests that ask Microsoft 365 users to enroll a new Entra passkey. [...]","A threat actor tracked as O-UNC-066 (Pink extortion gang) has been running a vishing campaign since April targeting Microsoft 365 users across multiple sectors. The attack exploits Microsoft's May 2026 passkey registration campaign feature, using phone calls and phishing kits that mimic legitimate Entra enrollment portals to harvest credentials and MFA responses. Once compromised, attackers register passkeys under their control and rapidly exfiltrate data from SharePoint and OneDrive before demanding ransom.","Pink extortion gang targets Microsoft 365 users with Entra passkey enrollment vishing campaigns.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fentra-passkey-enrollment-vishing-targets-microsoft-365-users\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F07\u002F08\u002Fpink.jpg","2026-07-08T16:47:25+00:00","2026-07-08T18:00:23.519837+00:00",9,[17,20,23,25,27,30],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"Microsoft Entra","product",{"name":24,"type":22},"Microsoft 365",{"name":26,"type":19},"Okta",{"name":28,"type":29},"Pink","threat_actor",{"name":31,"type":29},"The Com","2c8f44d4-b56e-47cf-9677-04f22c9ee78d",{"id":32,"icon":34,"name":35,"slug":36},null,"Identity & Access","identity-access",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54],{"type":42,"value":28,"context":55},"Extortion gang and phishing kit operation attributed to O-UNC-066; runs vishing campaigns and publishes stolen data on extortion site",[18,26,21],{"controls":58,"vendors":138},[59,86,112],{"slug":60,"name":61,"problem":62,"products":63},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[64,72,79],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":73,"vendor_name":26,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":80,"vendor_name":18,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":87,"name":88,"problem":89,"products":90},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[91,99,104],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":80,"vendor_name":18,"vendor_logo":81,"product_slug":100,"product_name":101,"url":102,"description":103},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"slug":113,"name":114,"problem":115,"products":116},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[117,124,130],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":118,"product_name":121,"url":122,"description":123},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":125,"product_name":126,"url":128,"description":129},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[139,142],{"slug":80,"name":18,"logo_path":81,"roles":140},[141],"affected",{"slug":73,"name":26,"logo_path":74,"roles":143},[144],"reported_by",{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":164},"vishing-campaign-hijacks-entra-passkey-enrollment-to-compromise-m365-accounts","Vishing Campaign Hijacks Entra Passkey Enrollment to Compromise M365 Accounts","The O-UNC-066 threat actor exploited user unfamiliarity with Microsoft's new passkey registration process by impersonating legitimate Entra enrollment portals via phone and phishing kits, tricking users into surrendering credentials and MFA tokens. Because passkeys are designed as strong authenticators, once an attacker registers one under their control they effectively achieve persistent, phishing-resistant access to the victim's account — turning a security feature into a persistence mechanism. The rapid follow-on exfiltration from SharePoint and OneDrive before a ransom demand highlights how a single social-engineering success can cascade into a full data-breach event. This attack matters because it weaponizes a security improvement rollout itself, meaning organizations that fail to train users on legitimate enrollment workflows inadvertently create a new attack surface during the transition period.",[150,151,152,153,154,155,156,157,158,159,160,161,162,163],"CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 6 – Access Control Management","CIS Control 14 – Security Awareness and Skills Training","CIS Control 17 – Incident Response Management","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 AC-17 – Remote Access","NIST SP 800-53 IA-5 – Authenticator Management","NIST SP 800-53 SI-4 – System Monitoring","NIST SP 800-63B – Digital Identity Guidelines (Phishing-Resistant AAL3)","MITRE ATT&CK T1598 – Phishing for Information","MITRE ATT&CK T1621 – Multi-Factor Authentication Request Generation","MITRE ATT&CK T1530 – Data from Cloud Storage Object","GDPR Article 32 – Security of Processing","GDPR Article 33 – Notification of a Personal Data Breach",{}]