type: entity · created: 2026-07-11 · updated: 2026-07-11 · tags: [cybercrime-group, technique] · confidence: medium · affected_sectors: [technology, healthcare, manufacturing, finance] · au_impact: false
O-UNC-066
O-UNC-066 is a threat actor tracked by Okta that uses voice phishing (vishing) to trick Microsoft 365 users into enrolling fake Microsoft Entra passkeys, thereby granting the attacker persistent access to victims' Microsoft 365 environments.
Attack Method
- Vishing call: Attacker calls the target, claims they need to register a new security passkey
- Fake enrollment flow: Victim is directed to a phishing kit that is identical to the legitimate Microsoft Entra passkey enrollment process (raw/digests/Cyber-Digest-2026-07-10)
- Credential theft: The fake passkey enrollment gives the attacker persistent access to the victim's Microsoft 365 account
- Bypasses MFA: The passkey-based approach circumvents traditional multi-factor authentication protections
Targets
The campaign targets a broad range of sectors, including: - Food & Beverage - Technology - Healthcare - Automotive - Construction - Aviation
Anyone with a Microsoft 365 tenant is potentially at risk. (raw/digests/Cyber-Digest-2026-07-11)
Related Pages
- Hallusquatting — Other AI/technique-based attack methods
- Mcp Tool Poisoning — AI agent attack techniques