Vishing Campaign Hijacks Entra Passkey Enrollment to Compromise M365 Accounts
Written by AI from the linked story. Not reviewed by an editor. How this works
The O-UNC-066 threat actor exploited user unfamiliarity with Microsoft's new passkey registration process by impersonating legitimate Entra enrollment portals via phone and phishing kits, tricking users into surrendering credentials and MFA tokens. Because passkeys are designed as strong authenticators, once an attacker registers one under their control they effectively achieve persistent, phishing-resistant access to the victim's account — turning a security feature into a persistence mechanism. The rapid follow-on exfiltration from SharePoint and OneDrive before a ransom demand highlights how a single social-engineering success can cascade into a full data-breach event. This attack matters because it weaponizes a security improvement rollout itself, meaning organizations that fail to train users on legitimate enrollment workflows inadvertently create a new attack surface during the transition period.
Tactical Insight
Immediate actions
- Notify all Microsoft 365 users that legitimate Entra passkey enrollment will never be initiated via an unsolicited phone call, and distribute official enrollment guidance from your IT team.
- Restrict passkey and authenticator registration in Entra ID to trusted, named locations or require an additional admin-approved workflow before new passkeys are accepted.
- Review Entra ID sign-in and audit logs immediately for unexpected passkey registrations or bulk SharePoint/OneDrive download events.
Long-term improvements
- Implement a conditional access policy that flags or blocks passkey registrations originating outside of managed devices or known corporate networks.
- Enforce a registration campaign communication standard: all enrollment actions must originate from internal IT ticketing systems with verifiable links, never from inbound calls.
- Conduct regular, targeted security awareness training that specifically covers vishing tactics and social-engineering scenarios mimicking IT helpdesk or vendor enrollment flows.
Detection measures
- Configure Microsoft Sentinel or Defender for Cloud Apps alerts to trigger on anomalous bulk file downloads from SharePoint/OneDrive within a short time window after any new MFA device registration.
- Establish a baseline for passkey/authenticator registrations per tenant and alert on deviations, enabling rapid revocation before data exfiltration occurs.
- Integrate threat intelligence feeds tracking O-UNC-066 infrastructure (phishing kit domains, caller ID patterns) into your SIEM for proactive blocking.