[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6UhGKpW-qS1EIQb2ggO5l2b39OQdVk6DIncKmXsJ_P4":3},{"article":4,"iocs":55,"watch_terms":69,"solutions":70,"lesson":155},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"016ba73a-abf0-4968-b608-62bd49db7ded","Okta Warns of Vishing Attacks Targeting Microsoft 365 Customers","okta-warns-of-vishing-attacks-targeting-microsoft-365-customers-68f448","The attackers call victims to direct them to phishing websites mirroring Microsoft Entra ID login pages. The post Okta Warns of Vishing Attacks Targeting Microsoft 365 Customers appeared first on SecurityWeek.","Okta has identified a vishing campaign, tracked as O-UNC-066, targeting organizations across multiple sectors to harvest Microsoft 365 credentials. Attackers use voice calls to direct victims to fake Microsoft Entra ID login pages, mimicking passkey registration to gain account access and potentially perform data extortion. The campaign leverages a custom PHP panel that guides victims through authentication and MFA stages in near real-time.","Okta warns of vishing campaign using fake passkey registration to steal Microsoft 365 credentials.","https:\u002F\u002Fwww.securityweek.com\u002Fokta-warns-of-vishing-attacks-targeting-microsoft-365-customers\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F07\u002Fvishing.jpeg","2026-07-10T11:06:36+00:00","2026-07-10T12:00:24.637761+00:00",8,[17,20,22,25,28,30],{"name":18,"type":19},"Microsoft 365","product",{"name":21,"type":19},"Microsoft Entra ID",{"name":23,"type":24},"Okta","vendor",{"name":26,"type":27},"O-UNC-066","threat_actor",{"name":29,"type":27},"CL-CRI-1147",{"name":31,"type":27},"Pink","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":54},{"id":32,"icon":34,"name":35,"slug":36},[56,60,63,66],{"type":57,"value":58,"context":59},"mitre_attack","T1566.002","Phishing: Spearphishing Link",{"type":57,"value":61,"context":62},"T1078.004","Valid Accounts: Cloud Accounts",{"type":57,"value":64,"context":65},"T1110.003","Brute Force: Password Guessing",{"type":57,"value":67,"context":68},"T1041","Exfiltration Over C2 Channel",[23,18,21],{"controls":71,"vendors":151},[72,99,125],{"slug":73,"name":74,"problem":75,"products":76},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[77,85,92],{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":86,"vendor_name":23,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":21,"url":97,"description":98},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":100,"name":101,"problem":102,"products":103},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[104,112,120],{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":121,"product_name":122,"url":123,"description":124},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"slug":126,"name":127,"problem":128,"products":129},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[130,137,143],{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":131,"product_name":134,"url":135,"description":136},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":138,"product_name":139,"url":141,"description":142},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[152],{"slug":86,"name":23,"logo_path":87,"roles":153},[154],"reported_by",{"slug":156,"title":157,"body":158,"framework_refs":159,"framework_notes":171},"vishing-campaign-harvests-microsoft-365-credentials-via-fake-entra-id-pages","Vishing Campaign Harvests Microsoft 365 Credentials via Fake Entra ID Pages","The O-UNC-066 campaign exploits human trust rather than technical vulnerabilities, using voice calls to socially engineer victims into submitting credentials and MFA codes to attacker-controlled phishing pages that mimic Microsoft Entra ID. A custom PHP panel enables attackers to relay captured credentials in near real-time, effectively bypassing multi-factor authentication through an adversary-in-the-middle (AiTM) technique. This matters because even organizations with MFA deployed can be compromised when employees are not trained to verify the legitimacy of unsolicited authentication requests. The combination of voice-based manipulation and phishing-resistant MFA bypass highlights how technical controls alone are insufficient without strong human awareness layers.",[160,161,162,163,164,165,166,167,168,169,170],"CIS Control 14 – Security Awareness and Skills Training","CIS Control 6 – Access Control Management","CIS Control 9 – Email and Web Browser Protections","NIST SP 800-63B – Digital Identity Guidelines (Phishing-Resistant Authenticators)","NIST AC-2 – Account Management","NIST AC-17 – Remote Access","NIST AT-2 – Literacy Training and Awareness","NIST IR-6 – Incident Reporting","MITRE ATT&CK T1598.004 – Phishing for Information: Vishing","MITRE ATT&CK T1111 – Multi-Factor Authentication Interception","GDPR Article 32 – Security of Processing (organizational measures to protect personal data)",{}]