Okta Warns of Vishing Campaign Using Fake Passkey Enrollment Pages
Summary
Okta says a campaign uses vishing and fake Microsoft Entra ID passkey pages to target organizations. Its operator-controlled phishing kit guides victims through authentication while the actor may enroll an attacker-controlled passkey.
Key points
- Okta says the campaign began in April and has targeted organizations in several sectors, mainly for data extortion.
- The group is tracked as O-UNC-066 and also known as CL-CRI-1147 and Pink.
- Voice calls direct victims to fake Microsoft Entra ID login pages under the pretense of registering a new passkey.
- The operator-controlled PHP panel adapts pages and notifications in near real time to handle different MFA methods.
- Okta says the actor likely uses victims’ credentials to access accounts and enroll an attacker-controlled passkey; the fake pages appear to mimic enrollment without registering a passkey themselves.
- The pages ask victims to save and verify a BIP-39 seed phrase, which Okta says has no apparent direct applicability in Microsoft Entra and may serve as a distraction.
- Microsoft sends the account owner a legitimate email when a passkey is registered, according to Okta.
Article Details
- Attack Vectors
- Voice calls direct victims to fake Microsoft Entra ID login pages under the pretense of registering a passkey.
- Victim-specific phishing pages mimic Microsoft passkey enrollment and request usernames, passwords, and MFA responses in a real-time, operator-controlled flow.
- The operator appears to use the stolen credentials to access victim accounts and register an attacker-controlled passkey.
- The phishing flow asks victims to save and verify a BIP-39 recovery phrase, which Okta says may serve as a distraction.
- Defensive Notes
- Review account activity and passkey registrations for unexpected changes; the article says legitimate Microsoft email notifications are sent when a new passkey is registered.
- Treat calls directing users to passkey-enrollment pages with caution, especially when the page requests credentials or MFA responses.
MITRE ATT&CK
T1056.003 · Web Portal CaptureThe phishing pages request usernames and passwords, which the operator likely uses in real time to access victim accounts.T1078.004 · Cloud AccountsThe operator likely uses captured credentials to authenticate to victims’ Microsoft accounts.T1098.001 · Additional Cloud CredentialsThe operator registers an attacker-controlled passkey in a compromised Microsoft account, adding an authentication credential.T1566.004 · Spearphishing VoiceThe campaign uses voice calls to direct victims to fake Microsoft Entra ID login pages.
Threat Actors
CL-CRI-1147The article identifies CL-CRI-1147 as another name for the group tracked by Okta as O-UNC-066; the group is reported to conduct vishing and passkey-themed phishing for data extortion.PinkThe article identifies Pink as another name for the group tracked by Okta as O-UNC-066; the group is reported to conduct vishing and passkey-themed phishing for data extortion.
Vendors
Products
Microsoft 365 Apps for EnterpriseOrganizations across multiple sectors have been targeted in a vishing campaign aimed at harvesting Microsoft 365 credentials, Okta warns.Microsoft Entra IDThe campaign started in April and has involved voice calls directing the victims to fake Microsoft Entra ID login pages under the pretense that they need to register a new passkey.
Industries
AutomotiveTracked as O-UNC-066 and also known as CL-CRI-1147 and Pink, the hacking group has been targeting automotive, aviation, construction, food and beverage, healthcare, and technology organizations, mainly for dataAviationas O-UNC-066 and also known as CL-CRI-1147 and Pink, the hacking group has been targeting automotive, aviation, construction, food and beverage, healthcare, and technology organizations, mainly for data extortion.Constructionand also known as CL-CRI-1147 and Pink, the hacking group has been targeting automotive, aviation, construction, food and beverage, healthcare, and technology organizations, mainly for data extortion.Food and Beverageas CL-CRI-1147 and Pink, the hacking group has been targeting automotive, aviation, construction, food and beverage, healthcare, and technology organizations, mainly for data extortion.Healthcareand Pink, the hacking group has been targeting automotive, aviation, construction, food and beverage, healthcare, and technology organizations, mainly for data extortion.Technologyhacking group has been targeting automotive, aviation, construction, food and beverage, healthcare, and technology organizations, mainly for data extortion.