Fake Passkey Enrollment Scam Hijacks Microsoft 365 Accounts
Written by AI from the linked story. Not reviewed by an editor. How this works
Threat actor O-UNC-066 is exploiting user trust through voice phishing (vishing) combined with a custom phishing kit to manipulate victims into enrolling attacker-controlled passkeys into their Microsoft 365 accounts. Once enrolled, the attacker gains persistent, legitimate-looking access without needing the victim's password, bypassing traditional MFA protections. This attack is particularly dangerous because passkeys are widely perceived as a secure authentication method, making users less likely to question the enrollment process. The campaign highlights how social engineering can undermine even modern authentication technologies when users are not trained to recognize manipulation tactics. Organizations face serious data extortion risk if employees cannot identify and resist these sophisticated vishing scenarios.
Tactical Insight
Immediate actions
- Train all employees to recognize vishing tactics and establish a verified callback procedure before performing any account security actions requested via phone.
- Enforce a policy requiring users to initiate passkey or MFA device enrollment only through official, self-service portals — never at the direction of an inbound caller.
- Review Microsoft Entra audit logs immediately for any unexpected passkey or authentication method enrollments across all accounts.
Long-term improvements
- Implement Conditional Access policies in Microsoft Entra ID that restrict new authentication method registrations to trusted networks or require admin approval.
- Deploy a phishing-resistant MFA strategy that includes user education on passkey security and the risks of social-engineering-driven enrollment.
- Establish a formal identity governance process with periodic reviews of registered authentication devices for all privileged and standard user accounts.
Detection measures
- Configure alerts in Microsoft Entra ID and your SIEM for new passkey or authentication method enrollments, especially outside business hours or from unfamiliar locations.
- Monitor for anomalous login patterns following any new device or passkey registration as an indicator of account compromise.
- Integrate threat intelligence feeds covering phishing kits and vishing campaigns targeting Microsoft 365 to enable proactive detection.