Passkey Enrollment Vishing: Forensics Against a Trust Hijack
22.07.2026 passkeyentra idvishingidentity forensicsphishing-resistant mfa
When the Strongest Factor Becomes the Trap
Passkeys have long been billed as the gold standard against phishing: cryptographic key pairs, origin-bound via WebAuthn, private keys that never leave the device. That’s exactly what makes the campaign run by O-UNC-066 — tracked by Okta Threat Intelligence, identified by Palo Alto Networks Unit 42 as “Pink” (aka CL-CRI-1147), and linked to the loosely organized “The Com” network behind Scattered Spider and ShinyHunters — so notable. Okta Threat Intelligence published a full technical analysis of the campaign on July 6, 2026. It doesn’t break cryptography — it hijacks the moment a strong credential is created in the first place.
The central trick is brutally simple: instead of stealing a password, a one-time code, or proxying an entire login session, the attackers persuade employees to add a new authenticator to their own Microsoft 365 account — one controlled by the attacker. Targeted employees are contacted by phone under the pretext that they must enroll a new Microsoft Entra passkey for security reasons, and are directed to phishing URLs containing the word “passkey” that include the victim organization’s branding and mimic the real Entra enrollment portal. Victims span food and beverage, technology, healthcare, automotive, construction, and aviation.
The timing is deliberate: since May 2026, Microsoft administrators have been able to create passkey registration campaigns that “nudge” users to enroll at sign-in — in some configurations on by default. That makes the fake request feel routine rather than suspicious.
Anatomy of the Attack: A Live Panel, Not an AiTM Proxy
Technically, this differs from classic adversary-in-the-middle phishing. Instead of the more common AiTM proxy, the kit is an operator-controlled PHP panel in which the attacker guides the victim through the phishing process in real time, adapting the flow to the MFA method in use. A human operator sits at the controls, relaying push prompts, TOTP codes, or SMS challenges as they come.
The most deceptive touch: a fake “recovery key” page shows a BIP-39 seed phrase, a trick borrowed from crypto wallets. Those pages enroll nothing — they simply keep the user busy while the attacker registers a passkey under their own control. The victim believes they’re securing a recovery key; in reality, the hostile enrollment ceremony is running in parallel. The primary motivation is data extortion, and since May 31, 2026, the group has operated its own leak site.
Hunting the Evidence in Entra Logs
For incident responders, this attack type shifts the focus away from token theft toward credential-registration events. The critical forensic marker is the “Add Passkey” audit entry, queryable via KQL as AuditLogs | where Category == "UserManagement" | where OperationName == "Add Passkey (device-bound)", extended with the target user and FIDO key ID.
Retention is the catch: Entra ID stores sign-in and audit logs for only 7 days on the free tier or 30 days on P1/P2 by default — often insufficient for forensic analysis, since many breaches are discovered more than 30 days after initial compromise. Reconstructing this campaign after the fact requires logs already exported ahead of time, ideally via Diagnostic Settings into a Log Analytics workspace, Sentinel, an Event Hub, or a storage account for cold archival.
A practical three-step investigative approach applies: first, correlate new “Add Passkey” events with unusual sign-ins or unexpected helpdesk contact — a recommendation echoed in coverage of the campaign, which advises teams to review Microsoft Entra audit logs for recent passkey additions, especially those following unusual sign-ins or helpdesk-style user reports. Second, cross-check the registered FIDO key ID and device attributes against known corporate hardware — an unfamiliar authenticator type or an atypical IP/geolocation at enrollment time is a strong indicator. Third, reconstruct the human layer: who called, under what pretext, from what number? Because this attack relies on social engineering rather than a technical bypass, rebuilding the phone and helpdesk interaction is now an essential part of the evidentiary picture.
The takeaway for DFIR teams: passkeys remain cryptographically phishing-resistant. But the enrollment ceremony itself has become a new perimeter — one that needs the same logging, monitoring, and forensic scrutiny as any other privileged action across the identity stack.
← Back to overview