[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbk680epfdrv_dsEfkVP23TrSQruIPNPBuEOr_DQOp48":3},{"article":4,"iocs":54,"watch_terms":57,"solutions":58,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"4aad1e57-f9f9-4ee5-81bc-5176dcdc9483","Hackers Use Fake Microsoft Entra Passkey Enrollment to Gain Microsoft 365 Access","hackers-use-fake-microsoft-entra-passkey-enrollment-to-gain-microsoft-365-access-44e86b","A threat actor has been targeting organizations spanning multiple sectors with voice-based fake security requests that prompt Microsoft 365 users to enroll a new Entra passkey with an aim to carry out data extortion attacks. The threat actor, tracked by Okta under the moniker O-UNC-066, has deployed a panel-controlled phishing kit that's capable of targeting the passkey enrollment process. The","A threat actor, known as O-UNC-066, is using voice phishing (vishing) and a custom phishing kit to trick Microsoft 365 users into enrolling the attacker's passkey into their accounts. This allows the threat actor to gain unauthorized access and potentially conduct data extortion attacks across various industries.","Hackers use vishing and fake Entra passkey enrollment to gain Microsoft 365 access.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fhackers-use-fake-microsoft-entra.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEh1L4YdSw3-1jg88TMzYxjsqRmu3Bq-VkmyGg742mMsJaIyhyaBk5MBeEFOxagE4H6GFjfH8ey1114iqyT0LuKYFdu7ocZhOrA3WQCvtNZGBknEJ1wTdb5vJ-M8w5kLXaUoBi39TXducoH8jZVrQ1xQQsBtEf0rrGJGfappdR1CrSB3xvaJC8Dgos2XdC37\u002Fs1600\u002FMicrosoft-Entra-Passkey-Enrollment.jpg","2026-07-10T10:30:20+00:00","2026-07-10T12:00:16.398744+00:00",8,[17,20,22,25,28],{"name":18,"type":19},"Microsoft 365","product",{"name":21,"type":19},"Microsoft Entra",{"name":23,"type":24},"Okta","vendor",{"name":26,"type":27},"O-UNC-066","threat_actor",{"name":29,"type":30},"passkey","technology","2c8f44d4-b56e-47cf-9677-04f22c9ee78d",{"id":31,"icon":33,"name":34,"slug":35},null,"Identity & Access","identity-access",[37,39,44,49],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55],{"type":43,"value":26,"context":56},"Threat actor moniker tracked by Okta",[23,18,21],{"controls":59,"vendors":142},[60,88,117],{"slug":61,"name":62,"problem":63,"products":64},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[65,73,80],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":74,"vendor_name":23,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":89,"name":90,"problem":91,"products":92},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"slug":118,"name":119,"problem":120,"products":121},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[122,129,135],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":118,"product_name":126,"url":127,"description":128},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":130,"product_name":131,"url":133,"description":134},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":136,"product_name":139,"url":140,"description":141},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[143,146],{"slug":110,"name":111,"logo_path":112,"roles":144},[145],"affected",{"slug":74,"name":23,"logo_path":75,"roles":147},[148],"reported_by",{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":166},"fake-passkey-enrollment-scam-hijacks-microsoft-365-accounts","Fake Passkey Enrollment Scam Hijacks Microsoft 365 Accounts","Threat actor O-UNC-066 is exploiting user trust through voice phishing (vishing) combined with a custom phishing kit to manipulate victims into enrolling attacker-controlled passkeys into their Microsoft 365 accounts. Once enrolled, the attacker gains persistent, legitimate-looking access without needing the victim's password, bypassing traditional MFA protections. This attack is particularly dangerous because passkeys are widely perceived as a secure authentication method, making users less likely to question the enrollment process. The campaign highlights how social engineering can undermine even modern authentication technologies when users are not trained to recognize manipulation tactics. Organizations face serious data extortion risk if employees cannot identify and resist these sophisticated vishing scenarios.",[154,155,156,157,158,159,160,161,162,163,164,165],"CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 14 – Security Awareness and Skills Training","NIST SP 800-63B – Digital Identity Guidelines (Authentication)","NIST AC-2 – Account Management","NIST IA-5 – Authenticator Management","NIST AT-2 – Literacy Training and Awareness","NIST SI-4 – System Monitoring","GDPR Article 32 – Security of Processing","ISO\u002FIEC 27001 A.9.4 – System and Application Access Control","Microsoft Zero Trust Identity Pillar – Verified Identity",{}]