Fake Voice Calls Trick Microsoft 365 Users Into Enrolling Malicious Passkeys

A threat actor tracked as O-UNC-066 is using voice-based phishing to trick Microsoft 365 users into enrolling fake Entra passkeys, enabling account takeover and data extortion. The attack targets organizations across multiple sectors with a panel-controlled phishing kit. Okta identified the campaign, which exploits the passkey enrollment process to gain persistent access.