Vishing Campaign Harvests Microsoft 365 Credentials via Fake Entra ID Pages
Written by AI from the linked story. Not reviewed by an editor. How this works
The O-UNC-066 campaign exploits human trust rather than technical vulnerabilities, using voice calls to socially engineer victims into submitting credentials and MFA codes to attacker-controlled phishing pages that mimic Microsoft Entra ID. A custom PHP panel enables attackers to relay captured credentials in near real-time, effectively bypassing multi-factor authentication through an adversary-in-the-middle (AiTM) technique. This matters because even organizations with MFA deployed can be compromised when employees are not trained to verify the legitimacy of unsolicited authentication requests. The combination of voice-based manipulation and phishing-resistant MFA bypass highlights how technical controls alone are insufficient without strong human awareness layers.
Tactical Insight
Immediate actions
- Train all employees to never initiate or complete passkey/MFA registration steps prompted by an unsolicited phone call, regardless of caller identity.
- Replace SMS/TOTP-based MFA with phishing-resistant options such as FIDO2/WebAuthn hardware security keys for Microsoft 365 accounts.
Long-term improvements
- Implement a verified callback procedure requiring users to hang up and call official support numbers before acting on any credential-related phone requests.
- Enforce Conditional Access policies in Microsoft Entra ID to restrict logins from unmanaged or unexpected devices and geographies.
- Establish a formal vishing/phishing simulation program with regular tabletop exercises to keep employee vigilance high.
Detection measures
- Monitor Microsoft Entra ID sign-in logs and alert on anomalous passkey registration events or MFA method changes initiated outside of normal business workflows.
- Deploy anti-phishing DNS filtering and threat intelligence feeds to detect and block domains mimicking Microsoft Entra ID login pages in near real-time.