\u201cThe operator can use the kit to adapt the user experience to each victim\u2019s MFA requirements (TOTP, push notification with number matching, SMS OTP) during the session,\u201d the researchers noted.<\/p>\n
The kit shows loading screens between the separate phishing pages, giving the attackers time to use the entered credentials and authentication factors to log in to the targets\u2019 Microsoft 365 accounts.<\/p>\n
Once access is achieved, they serve the targets with a page asking them to set up a passkey. <\/p>\n
The next page shows a Microsoft-branded prompt with a list of BIP-39 seed phrase words<\/a> (borrowed from cryptocurrency wallets), and tells the target to write them down:<\/p>\n The \u201cSave your recovery key\u201d phishing page (Source: Okta)<\/p>\n Finally, they are instructed to enter one of them to \u201cconfirm\u201d their recovery key, and when they do, they are served a page that confirms that a passkey registration was successful.<\/p>\n \u201cWe are not aware of any direct applicability of BIP-39 seed phrases to Microsoft Entra or its passkey registration process. An attacker that has already gained unauthorized access to a user account can create their own recovery codes using a process that does not require any input from the real account holder,\u201d Okta researchers noted.<\/p>\n \u201cIt is likely that these passkey-themed pages are available to the phishing kit operator as a sleight of hand. It is a distraction to keep a user occupied on a task while the threat actor enrolls their own passkey in the legitimate Microsoft user account.\u201d<\/p>\n Why passkeys make such a good lure<\/p>\n Passkeys are a genuine security improvement: they are phishing-resistant and cryptographically bound to the site that issued them, which is exactly why an attacker would want to enroll one on a target\u2019s account.<\/p>\n \u201cAs of May 2026, Microsoft administrators have been able to create passkey registration campaigns that remind or \u2018nudge\u2019 users to enrol in passkeys at sign-in, and in some circumstances these nudges are on by default,\u201d Okta researchers explained<\/a>.<\/p>\n With enrollment prompts now appearing unbidden in Entra ID tenants, and employees getting used to seeing them, they make the perfect pretext.<\/p>\n Okta has observed this campaign targeting enterprises in the food and beverage, technology, healthcare, automotive, construction, and aviation industries, and says that the goal is data extortion.<\/p>\n Palo Alto Networks researchers documented<\/a> the same campaign in early June 2026. They say that the after gaining access to the victim\u2019s account, the attackers exfiltrate data from platforms like SharePoint and OneDrive, then use the compromised account to send their initial extortion email and internal Teams messages.<\/p>\n They also tied this campaign to the Pink data extortion group\/brand, which say is likely a threat actor affiliated with The Com<\/a>, a decentralized network of mostly English-speaking and mostly young cybercriminals who organize across Discord, Telegram, and gaming platforms.<\/p>\n![\"Microsoft](\"https:\/\/www.europesays.com\/ie\/wp-content\/uploads\/2026\/07\/fake-ms-passkey-enrolment.webp\" "\\"The")
<\/p>\n![](\"https:\/\/www.europesays.com\/ie\/wp-content\/uploads\/2026\/07\/devider.webp\"\/)
<\/p>\n