What's Happening
O-UNC-066 runs a vishing (voice phishing) campaign targeting enterprise Microsoft 365 tenants. The playbook: call an employee, impersonate IT support, explain there's a “security upgrade” required, and direct them to a pixel-perfect fake Microsoft Entra passkey enrollment portal. The employee enrolls what they believe is their own passkey. What actually gets registered is an attacker-controlled credential — binding the attacker's device to the employee's M365 identity. The attacker now has persistent, phishing-resistant access. The employee has no idea.
Targeted sectors include banking, healthcare, aviation, and automotive. These are not unsophisticated environments — many run YubiKeys, conditional access policies, and Entra ID Premium. None of that prevented this attack, because the attack does not touch any of those controls. It goes around them by attacking the enrollment moment.
Why Okta and Entra Can't Close This
Okta and Microsoft Entra are world-class identity platforms. They enforce phishing-resistant auth after enrollment is complete. The problem is that the enrollment workflow may not independently answer the question:“Is the person enrolling this credential the person they claim to be?”
Enrollment trust typically relies on one of three things:
- An email link sent to the user's existing inbox — interceptable, redirectable
- An existing authenticated session — which can be the result of prior social engineering
- An IT-managed provisioning flow — which is what O-UNC-066 is impersonating
These approaches can leave enrollment dependent on a channel or session that a remote attacker may try to manipulate. Customers should treat enrollment as a distinct risk point and apply verification, monitoring, and response controls.
Enrollment and Recovery Both Matter
BioAuth is designed to bind supported enrollment and authorization events to device-mediated user approval rather than relying only on a link, call, or inherited session.
Its recovery experience adds verification and audit controls intended to reduce the chance that a remotely obtained session becomes durable account control. Detailed mechanisms are limited to authorized technical materials.
Customers should still use layered enrollment monitoring, device policy, and incident response appropriate to their threat model.
Why This Matters Now
Every major enterprise that has deployed Entra passkeys in the last 18 months is in O-UNC-066's target profile. The attack works precisely because the enterprise has sophisticated auth — employees are primed to expect enrollment prompts, updates, and “security upgrades.” The very success of the passkey rollout creates the social engineering surface.
For developers building auth flows on top of identity providers: the enrollment moment is your weakest point, and your identity provider is not protecting it. Phishing-resistant auth after enrollment is necessary but not sufficient. The enrollment event itself needs independent user verification, and the recovery path needs controls appropriate to remote social-engineering risk.
The Takeaway
O-UNC-066 found the seam in the passwordless migration. They are not attacking passkeys — they are attacking the moment before passkeys exist, and the recovery path that persists after them. Okta and Entra harden the steady state. They do not harden the transition or the exception.
BioAuth addresses both enrollment and recovery with supported user-verification and audit controls. It is designed to reduce — not eliminate — the risk that remote social engineering becomes persistent account access.