Vishing Campaign Uses Fake Entra Passkey Enrollment to Target Microsoft 365 Users
Summary
Okta says O-UNC-066, linked to the Pink extortion operation, has used vishing and fake Entra passkey pages to capture Microsoft 365 credentials and MFA responses and register attacker-controlled passkeys.
Key points
- Okta attributes the campaign to O-UNC-066, which it links to the Pink extortion operation.
- Since April, the actor has reportedly called users and directed them to fake Microsoft Entra passkey enrollment pages.
- The phishing kit uses an operator-controlled PHP panel that adapts the authentication flow in real time to users' MFA methods.
- Credentials and MFA responses entered into the kit are relayed to the operator, who can register a passkey they control on the victim's account.
- Okta says the campaign targets organizations in several sectors, including healthcare, technology, food and beverage, and aviation.
- Okta recommends verifying helpdesk personnel who contact users and denying requests from locations where the organization does not operate.
Article Details
- Event Type
- Vishing-enabled credential and MFA phishing campaign targeting Microsoft 365 users; Okta attributes the activity to O-UNC-066 and links it to the Pink extortion operation.
- Impact
- The phishing kit relays victims’ credentials and MFA responses to operators, who use them to access victim accounts and register attacker-controlled passkeys. Pink is reported to rapidly exfiltrate data from SharePoint and OneDrive and to publish samples of stolen data to pressure victims to pay.
MITRE ATT&CK
T1056.003 · Web Portal CaptureA phishing kit mimicking the Entra enrollment portal captures credentials and MFA responses.T1078 · Valid AccountsThe operators use captured credentials and MFA responses to authenticate to victims’ Microsoft accounts.T1098.001 · Additional Cloud CredentialsAfter gaining access, the attacker registers a passkey under their control on the victim’s account.T1566.004 · Spearphishing VoiceThe operators use phone calls under a false security pretext to persuade users to enroll a passkey.T1567.002 · Exfiltration to Cloud StoragePink is reported to exfiltrate victim data from SharePoint and OneDrive.
People
Threat Actors
PinkDescribed as an extortion operation that uses vishing and IT impersonation to obtain credentials and MFA codes, steals company data, and publishes samples of stolen data to pressure victims to pay.The ComDescribed as a decentralized threat network to which the Pink extortion brand is affiliated; the article does not separately attribute specific operations to The Com.
Vendors
Products
Microsoft 365 Apps for EnterpriseA threat actor is using vishing and fake Microsoft Entra passkey enrollment requests to trick Microsoft 365 users into handing over credentials and MFA responses.Microsoft EntraA threat actor is using vishing and fake Microsoft Entra passkey enrollment requests to trick Microsoft 365 users into handing over credentials and MFA responses.Microsoft OneDrivePink targets multiple sectors and quickly exfiltrates data from SharePoint and OneDrive.Microsoft SharePointPink targets multiple sectors and quickly exfiltrates data from SharePoint and OneDrive.
Industries
AutomotiveOkta says that O-UNC-066 has been targeting users at organizations in the food and beverage, technology, healthcare, automotive, construction, and aviation industries.AviationOkta says that O-UNC-066 has been targeting users at organizations in the food and beverage, technology, healthcare, automotive, construction, and aviation industries.ConstructionOkta says that O-UNC-066 has been targeting users at organizations in the food and beverage, technology, healthcare, automotive, construction, and aviation industries.Food and BeverageOkta says that O-UNC-066 has been targeting users at organizations in the food and beverage, technology, healthcare, automotive, construction, and aviation industries.HealthcareOkta says that O-UNC-066 has been targeting users at organizations in the food and beverage, technology, healthcare, automotive, construction, and aviation industries.TechnologyOkta says that O-UNC-066 has been targeting users at organizations in the food and beverage, technology, healthcare, automotive, construction, and aviation industries.