Vishing actors target Entra passkey enrollment

Reported 10 Jul 2026 by otx · Severity: medium

Since April 2026, threat actors operating under O-UNC-066 have deployed a sophisticated vishing campaign targeting Microsoft 365 passkey enrollment. Attackers register domains containing 'passkey' and call victims to convince them to register new passkeys. Victims are directed to