Vishing Campaign Targets Microsoft 365 Passkey Enrollment, Okta Says

Summary

Okta reports that O-UNC-066, also known as Pink, has used vishing and a phishing kit to trick Microsoft 365 users into authorizing fraudulent passkeys. The activity has been observed across industries; no direct Microsoft account compromise was observed.

Key points

• Okta says the O-UNC-066 cluster, also known as Pink, has targeted enterprise organizations since April 2026.
• Attackers use phone calls and domains containing “passkey” to direct users to a phishing kit that mimics Microsoft’s enrollment flow.
• The scheme is designed to have a threat actor register a passkey in the targeted user’s Microsoft account while the user believes they are enrolling their own.
• Okta observed the activity across several industries and describes data extortion as the actors’ primary motivation.
• The kit does not handle federation to third-party identity providers, and Okta has not observed direct Microsoft account compromise.

MITRE ATT&CK

Threat Actors

Vendors

Products

Industries

Related Articles

• Wiz Details ARTEX-Using Actor’s Automated Targeting of IT and Software Vendorswiz.ioMicrosoft 365 Apps for Enterprise · Microsoft · Okta
• Microsoft Says Outlook Zero-Day Was Exploited as It Patches 1,094 Flawssecurityweek.comMicrosoft 365 Apps for Enterprise · Microsoft
• Threat Actors Repurpose AI Pen-Testing Tool Artex for Automated Attacksdarkreading.comMicrosoft 365 Apps for Enterprise · Microsoft
• How to Choose Between Microsoft 365 Native and Third-Party Securityhornetsecurity.comMicrosoft 365 Apps for Enterprise · Microsoft
• Chainalysis Says Attack Exposed All Users’ Credentials, Takes Services Offlinethehackernews.comMicrosoft 365 Apps for Enterprise · Microsoft