Passkeys were built to close the door on phishing by replacing passwords with device-bound cryptographic keys that cannot be typed into a fake login page. A vishing operation that Okta is tracking as O-UNC-066, and that runs a data-leak site called Pink, found a way around that design. Instead of trying to steal a passkey, the operator gets a victim on the phone and talks them into enrolling one, on the attacker’s device, for the attacker.
The shift: passkeys move from phishing-proof to phishing target
According to Okta’s threat intelligence team, the campaign has been running since April 2026 and has hit organizations across automotive, aviation, construction, food and beverage, healthcare, and technology. The pitch is simple: a caller impersonating internal IT or security staff tells the target that Microsoft is retiring password-only sign-in and that they need to register a new passkey immediately. The story works because it is close enough to true. Microsoft has spent two years pushing enterprises toward passkeys as a stronger, phishing-resistant replacement for passwords, and most employees have never actually walked through the enrollment flow themselves.
That unfamiliarity, Okta’s researchers wrote, is what the kit is built to exploit: “the phishing kit appears to prey on the lack of user familiarity with passkey authentication.”
How the vishing crew gets in
An operator-run panel, not a bot
The mechanics are hands-on rather than fully automated. A PHP-based phishing panel gives the live caller a real-time view of the victim’s session, starting with credential-harvesting pages at endpoints resembling Microsoft’s own /identify and /password flow. As soon as a victim enters a username and password, the operator relays those credentials into the real Microsoft sign-in page and watches which multi-factor challenge comes back: an SMS code, a time-based one-time code, or a push notification. Whichever it is, the caller talks the victim through approving or reading it out, defeating the specific MFA method in play rather than one fixed technique.
The recovery-phrase distraction
Once the session is live, the kit serves pages that look like Microsoft’s own passkey setup: a registration screen, a check step, and a completion page. What the victim is actually looking at, and reading aloud from, is a 12-word recovery phrase presented to keep them occupied while the operator enrolls a passkey under their own control directly on the compromised Microsoft account. From that point, the attacker holds a persistent, phishing-resistant credential of their own, on infrastructure the victim’s IT team has no reason to suspect.
Who is behind Pink
Okta attributes the campaign to a group that has run the Pink extortion site since April 2026 and links it to The Com, the loosely organized cybercrime network whose orbit has included Scattered Spider and ShinyHunters, the group behind this year’s Oracle PeopleSoft zero-day breach campaign. Palo Alto Networks Unit 42 tracks overlapping activity under the name CL-CRI-1147. The through-line across these groups is a preference for social engineering and live human operators over custom malware, a pattern also visible in the FBI’s warning that Russian intelligence has been targeting Signal backup recovery keys to get around encrypted messaging rather than breaking the encryption itself. In both cases, the attacker is not defeating the cryptography; they are defeating the recovery and enrollment process built around it.
That distinction matters for how defenders prioritize spending. Passkey adoption budgets have gone almost entirely toward the authentication moment itself: which standard to support, which devices to enroll, which platform to buy. Far less has gone toward the adjacent moments, enrollment, recovery, and help-desk escalation, that this campaign targets instead. Vishing crews are, in effect, arbitraging that imbalance: they are not trying to beat FIDO2 cryptography, they are walking through the door security teams left unlocked next to it.
Why live operators are winning where malware fails
The Pink campaign is also a data point in a broader pattern Okta and other identity vendors have flagged through 2026: the most effective identity attacks now involve a human on the phone, not a payload on the endpoint. A live caller can improvise, read a victim’s hesitation, and adapt to whatever MFA prompt appears, something a static phishing kit cannot do. That adaptability is precisely why the technique has spread across industries as different as aviation and food and beverage: it does not depend on any particular software stack, only on a help desk process that assumes a caller claiming to be IT probably is.
What it means for the security leader
Passkeys remain a genuine improvement over passwords and SMS codes, and nothing in this campaign breaks the underlying cryptography. But the rollout has exposed a gap that security leaders have been slow to close: enrollment and recovery are still governed by the same human trust decisions that phishing has always exploited, and a help-desk-style phone call remains one of the cheapest ways to manipulate them. Any organization that has told employees “call IT if you have trouble with your passkey” has, in effect, trained them to trust exactly the kind of call this kit relies on.
It also means the security team’s job does not end once passkeys are deployed. Enrollment itself needs to be treated as a privileged action, not a self-service convenience, because an attacker who gets to enroll a passkey has gained a durable credential that resists the very controls passkeys were meant to provide.
What to do
- Require passkey and MFA-method enrollment to happen through a verified, IT-initiated channel, never in response to an inbound call, and train help-desk staff to treat unsolicited enrollment requests as suspicious.
- Monitor for new passkey or authenticator registrations on existing accounts and alert on registrations from unfamiliar devices or locations, especially shortly after a support interaction.
- Brief staff specifically on this pattern: legitimate passkey enrollment is something they do for themselves at their own workstation, never something a caller walks them through.
- Review conditional access policies so a newly enrolled authentication method cannot immediately unlock high-privilege access without additional verification.
Source: Okta
