Pink Vishing Tricks Staff Into Entra Passkeys

How the Attack Worked

The group known as Pink (also tracked as O-UNC-066 or CL-CRI-1147) runs a voice phishing campaign against Microsoft 365 and Entra ID users, active since April 2026 and surging through July 2026. Callers pose as internal IT helpdesk staff, telling employees they need to complete a Microsoft Entra passkey enrollment step. Victims are directed to a realistic, employer-branded lookalike subdomain to sign in, timed to coincide with Microsoft's own passkey enrollment nudges so the request feels expected.

Once on the fake site, victims are shown a Microsoft-branded page presenting a list of BIP-39 seed phrases and told to write them down as an identity backup. This step has no legitimate place in Entra ID login flows. While the victim is occupied copying down the words, the attacker quietly registers their own persistent, phishing-resistant passkey on the victim's real Entra profile, gaining long-term access without needing further credentials or MFA prompts.

Why It Succeeded

The campaign blends several elements that make it hard to spot:

• Calls sound like routine internal IT compliance work rather than an obvious scam
• The lookalike login pages are branded to match the employer, not a generic phishing template
• The timing aligns with real Microsoft passkey enrollment prompts, reducing suspicion
• The fake recovery step borrows crypto-style language that many users have seen elsewhere and may assume is a modern security feature

This combination lets the attacker register a passkey that grants ongoing access, described as a definitive indicator of compromise once identified, without immediately alarming the victim.

What to Watch For

Employees and security teams should treat the following as red flags:

• An unsolicited call claiming urgent IT compliance action is needed
• Being directed to sign in through a link provided during a call rather than a known URL or bookmark
• Any corporate Microsoft login flow that displays crypto-style seed phrases or asks users to write down recovery words

Because BIP-39 seed phrases have no technical function within Microsoft Entra ID, seeing them during a corporate login should be treated as an active compromise signal.

Building Resistance

Organizations can reduce exposure to this pattern with a mix of process and technical controls:

• Establish out-of-band verification so staff hang up on unsolicited IT calls and confirm requests through known internal channels
• Train employees to avoid signing in through links given over the phone
• Restrict passkey registration to known corporate IP ranges through conditional access policies
• Monitor logs for newly bound passkeys, especially those given benign or generic names

These steps target the specific mechanics of this campaign, from the initial vishing call to the final passkey registration that gives attackers persistent access to systems like SharePoint and OneDrive.

What is the Pink vishing campaign?

It is a voice phishing operation in which callers impersonate internal IT helpdesk staff and direct employees to employer-branded lookalike login pages to hijack their Microsoft Entra ID accounts.

Why do attackers show a BIP-39 seed phrase during the attack?

The seed phrase screen is a distraction that keeps the victim occupied while the attacker registers their own phishing-resistant passkey on the victim's real Entra profile, since seed phrases have no legitimate role in Entra ID.

How can organizations stop unauthorized passkey enrollment?

Recommended mitigations include restricting passkey registration to known corporate IP ranges, monitoring logs for newly bound passkeys with benign names, and enforcing out-of-band verification for unsolicited IT calls.

What should employees do if they get an unexpected IT helpdesk call?

They should hang up and verify the request through a known internal number rather than following any link or instructions given during the call.