Actor Profile

The threat actor behind this campaign remains unattributed. The operation demonstrates sophistication in social engineering tactics, specifically targeting Microsoft 365 environments through voice-based phishing (vishing). The actor's motivation appears to be initial access acquisition to corporate Microsoft 365 tenants, likely for credential theft, data exfiltration, or follow-on intrusion activities. The use of Entra passkey enrollment as a lure indicates familiarity with Microsoft identity infrastructure and current authentication mechanisms, suggesting the actor has adapted tactics to exploit newer security features that users may be less familiar with.

TTPs (Tactics, Techniques, Procedures)

The campaign employs social engineering via vishing (T1598.004 - Phishing for Information: Spearphishing Voice) as the primary initial access vector. Attackers impersonate legitimate security personnel or IT support to establish trust and urgency. The core technique involves credential access through user manipulation (T1078 - Valid Accounts) by tricking victims into enrolling a malicious Entra passkey, effectively granting the attacker persistent authentication capability. This represents a form of multi-factor authentication manipulation (T1556 - Modify Authentication Process) where the victim unknowingly registers an attacker-controlled authentication factor. Once enrolled, the passkey provides the actor with valid account access (T1078.004 - Cloud Accounts) to Microsoft 365 environments without triggering traditional authentication alerts.

Targets & Patterns

The campaign targets Microsoft 365 users across multiple sectors, indicating an opportunistic or broad-spectrum targeting approach rather than sector-specific focus. The lack of geographic or industry constraints suggests the actor is either conducting reconnaissance at scale to identify vulnerable organizations, or is operating as an initial access broker seeking to compromise diverse targets for resale or follow-on operations. Organizations of any size using Microsoft 365 and Entra ID (formerly Azure AD) are potential victims. The targeting of passkey enrollment specifically suggests the actor is exploiting user unfamiliarity with newer passwordless authentication methods, which may be less understood than traditional MFA prompts. This broad targeting pattern is consistent with credential harvesting operations or access brokerage activities common in the cybercrime ecosystem.

Historical Context

This campaign represents an evolution in vishing tactics adapted to modern cloud authentication mechanisms. Traditional vishing campaigns have historically targeted one-time passwords, MFA push notifications, or recovery codes. The focus on Entra passkey enrollment reflects threat actor adaptation to passwordless authentication adoption in enterprise environments. This technique shares similarities with MFA fatigue attacks and adversary-in-the-middle (AiTM) phishing campaigns targeting Microsoft 365, but distinguishes itself through voice-based social engineering rather than technical interception. The campaign aligns with broader trends observed since 2022-2023 where attackers increasingly target cloud identity platforms and authentication mechanisms as initial access vectors, particularly as organizations migrate to cloud-first infrastructure.

Defensive Recommendations

  • Implement user awareness training specifically addressing vishing tactics and emphasizing that legitimate IT/security teams will never request passkey enrollment or MFA registration via unsolicited phone calls
  • Enable conditional access policies in Microsoft Entra ID to restrict passkey enrollment to trusted locations or require additional verification for authentication method changes (T1556 mitigation)
  • Monitor Entra ID audit logs for suspicious authentication method registrations, particularly passkey enrollments occurring shortly after or during unusual sign-in patterns or from unexpected geolocations
  • Establish and communicate clear internal procedures for authentication method changes, including requiring in-person verification or callback to known internal numbers before any credential modifications
  • Deploy anomaly detection for Microsoft 365 sign-ins following new passkey registrations, flagging access from new devices, IP addresses, or impossible travel scenarios (T1078.004 detection)