Okta reports a sophisticated vishing operation that has been harvesting Microsoft 365 credentials since April. Victims receive phone calls that redirect them to counterfeit Microsoft Entra ID login pages, exploiting the passkey enrollment flow.

Key Takeaways

  • The vishing campaign identified by Okta has been active since April 2024.
  • Attackers use voice calls to steer victims to fake Microsoft Entra ID login pages.
  • By hijacking the passkey enrollment process, hackers gain control of victim accounts.

Okta has disclosed a large‑scale vishing campaign that targets organizations across multiple sectors to steal Microsoft 365 credentials. Initiated in April 2024, the operation has already affected automotive, aviation, construction, food‑beverage, healthcare, and technology firms.

How the Deception Works

The threat actor, tracked as O‑UNC‑066 (also known as CL‑CRI‑1147), calls victims and claims they must register a new passkey. The call directs the user to a counterfeit Microsoft Entra ID login page that mimics Microsoft’s branding and pulls assets from the genuine Microsoft CDN. Each page is dynamically generated per victim, making detection extremely difficult.

Technical Mechanics

Unlike typical phishing kits, this operation uses an operator‑controlled PHP panel that does not automatically harvest credentials or MFA tokens. Instead, the attacker guides the victim through multiple authentication stages in near‑real‑time, adapting the page content to match the user’s MFA configuration (SMS OTP, TOTP, or push). The kit performs anti‑analysis checks, requests a username without redirecting to a federated identity provider, and then uses the supplied password in real‑time to access the account.

Exploiting Passkey Enrollment

After the victim reaches the passkey registration screen, they are asked to select a recovery phrase from a list of BIP‑39 seed words—an element that has no direct relevance to Microsoft Entra. This step appears to serve as a distraction while the attacker registers their own passkey under the victim’s account. Consequently, the legitimate Microsoft notification about a newly added passkey is actually confirming the attacker‑controlled credential.

Implications and Recommendations

The campaign highlights the growing sophistication of phone‑based social engineering that can undermine even the most modern authentication mechanisms. Organizations should treat unsolicited calls with suspicion, routinely audit MFA settings, and immediately flag any unexpected passkey enrollment requests. Strengthening user awareness around passkey workflows is now as critical as deploying technical controls.