Pink vishing crew targets Microsoft 365 passkey enrollment

There is a phone scam making the rounds that piggybacks on a genuinely useful Microsoft feature. Since May, Entra admins have been able to run passkey registration campaigns to nudge staff toward stronger authentication. A crew tracked by Okta as O-UNC-066, operating under the extortion brand Pink, has been ringing employees at Microsoft 365 customers and walking them through something that looks like exactly that process. It isn't.

The campaign has been active since April. Victims span food and beverage, tech, healthcare, automotive, construction and aviation. A caller claiming to be from internal IT tells the target they need to enrol a new Entra passkey "for security reasons", then directs them to a URL with the word passkey in the domain and their employer's branding on the landing page. What the victim registers is a passkey the attacker controls.

A human on the other end of the line

What makes this one worth paying attention to is the tooling. Instead of the usual adversary-in-the-middle proxy, Pink runs an operator-controlled PHP panel that polls once a second. A real person on the other end can steer the session live. If the target gets a Microsoft push with number matching, the operator sees it and adjusts. If it's TOTP or SMS OTP, same thing. Credentials and MFA responses flow straight to the attacker, who signs into the real Microsoft account while the victim is still clicking through fake pages.

It is a nice reminder that the phrase "MFA-resistant phishing kit" doesn't always mean automated proxying. Sometimes it just means someone on shift, watching a panel.

The BIP-39 thing

One flourish that made analysts blink: the fake enrollment flow asks the user to save a BIP-39 recovery phrase and confirm one of the words. BIP-39 is a convention from cryptocurrency wallets. It has nothing to do with Entra passkeys, or with Microsoft accounts, or with anything the real enrollment does.

Okta's read is that it's decorative. Give the unfamiliar user something official-looking to do, ideally something that eats a few minutes, while the real account takeover happens in a browser tab they can't see. It's a small window into how these operators think about pacing.

What happens once they're in

Once inside a tenant, Pink moves quickly:

• Straight to SharePoint and OneDrive
• Bulk data pulled out
• Samples posted on the extortion site the group launched at the end of May

No dwell time worth mentioning. This is a smash-and-grab tuned for maximum extortion leverage before anyone in the target org has finished their coffee.

The advice, restated

Okta's guidance is worth repeating. Staff need a reliable way to verify that the person calling from IT is actually from IT. Not "we'll send you a link to confirm", which is exactly what the attacker is already doing. Something the helpdesk uses that the attacker cannot spoof, and that everyone in the business actually knows about. Being suspicious of unsolicited helpdesk contact from regions where the business doesn't operate is a decent starting filter as well.

Passkeys are still one of the better authentication options going. They're phishing-resistant in the technical sense. What they can't do is stop a friendly voice on the phone from convincing someone to enrol the wrong one.