Hackers Use Fake Microsoft Entra Passkey Enrollment to Gain Microsoft 365 Access

A threat actor is targeting organizations across various sectors with fake security requests made via voice, aiming to trick Microsoft 365 users into enrolling a new Entra passkey. This tactic is part of a larger effort to carry out data extortion attacks. The threat actor, known as O-UNC-066, is using a phishing kit that can target the passkey enrollment process. The phishing kit is controlled through a panel, allowing the threat actor to manage their attacks. The goal of these attacks is to gain access to Microsoft 365 accounts.