Hackers Use Fake Microsoft Entra Passkey Enrollment to Gain Microsoft 365 Access

Threat actor O-UNC-066 is exploiting user trust through voice phishing (vishing) combined with a custom phishing kit to manipulate victims into enrolling attacker-controlled passkeys into their Microsoft 365 accounts. Once enrolled, the attacker gains persistent, legitimate-looking access without needing the victim's password, bypassing traditional MFA protections. This attack is particularly dangerous because passkeys are widely perceived as a secure authentication method, making users less likely to question the enrollment process. The campaign highlights how social engineering can undermine even modern authentication technologies when users are not trained to recognize manipulation tactics. Organizations face serious data extortion risk if employees cannot identify and resist these sophisticated vishing scenarios.