Entra passkey enrollment vishing targets Microsoft 365 users

A threat actor tracked as O-UNC-066 by Okta is targeting Microsoft 365 users with voice phishing calls that trick victims into enrolling a passkey controlled by the attacker. The campaign exploits a passkey registration feature Microsoft opened to administrators in May. The phishing kit uses an operator-controlled PHP panel with real-time heartbeat polling to adapt to each victim's MFA method.