Okta Warns of Vishing Attacks Targeting Microsoft 365 Customers
Okta warns of vishing campaign using fake passkey registration to steal Microsoft 365 credentials.
Okta has identified a vishing campaign, tracked as O-UNC-066, targeting organizations across multiple sectors to harvest Microsoft 365 credentials. Attackers use voice calls to direct victims to fake Microsoft Entra ID login pages, mimicking passkey registration to gain account access and potentially perform data extortion. The campaign leverages a custom PHP panel that guides victims through authentication and MFA stages in near real-time.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Okta?
Get an email when a new story names Okta, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe O-UNC-066 campaign exploits human trust rather than technical vulnerabilities, using voice calls to socially engineer victims into submitting credentials and MFA codes to attacker-controlled phishing pages that mimic Microsoft Entra ID. A custom PHP panel enables attackers to relay captured credentials in near real-time, effectively bypassing multi-factor authentication through an adversary-in-the-middle (AiTM) technique. This matters because even organizations with MFA deployed can be compromised when employees are not trained to verify the legitimacy of unsolicited authentication requests. The combination of voice-based manipulation and phishing-resistant MFA bypass highlights how technical controls alone are insufficient without strong human awareness layers.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- mitre_attack — T1566.002
- mitre_attack — T1078.004
- mitre_attack — T1110.003
- mitre_attack — T1041