Microsoft Entra Passkey Enrollment Abused in Operator

Gbhackers •Mayura Kathir • July 9, 2026

A focused vishing campaign that weaponizes Microsoft Entra passkey enrollment as a social-engineering vector to enable account takeover and downstream data extortion. The threat actor begins by registering domains that include the term “passkey” (for example, assignpasskey[.]com, deploypasskey[.]com, passkeydeploy[.]com, passkeyadd[.]com, setpasskey[.]com) and creating per-target subdomains. Microsoft Entra ID login pages. Pages load generic Microsoft styling […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Vishing Campaign Targets Microsoft 365 Passkey Enrollment Process Since April 2026, a threat actor identified as O-UNC-066, also known as 'Pink', has been executing a vishing campaign aimed at Microsoft 365 users. The campaign exploits a new passkey enrollment feature introduced by Microsoft in May 2026, targeting organizations in various sectors, including food and beverage, technology, and healthcare. Attackers call users, convincing them to register a new passkey, while directing them to a phishing site that mimics the legitimate Microsoft enrollment process. The phishing kit is designed to collect user credentials and MFA responses in real-time, allowing the attacker to gain unauthorized access to victims' accounts. Okta has observed this activity but has not confirmed any direct compromises of Microsoft accounts. The phishing URLs used in the campaign contain the word 'passkey' and are tailored to each victim's organization. The threat actor's ultimate goal appears to be data extortion. 6 sources 65

Extracted Entities

Domains (2)

assignpasskey.com setpasskey.com