Entra ID: The Fake Passkey Enrollment That Buys Durable Persistence

Passkeys are rightly presented as the strongest defense against phishing. A FIDO2 key cannot be replayed, does not leak into a database, and resists adversary-in-the-middle attacks. That is precisely why the campaign Okta described on July 10, 2026, is instructive: it does not break passkey cryptography, it attacks the moment that strong key is created. The actor, tracked as O-UNC-066 and also named Pink by Palo Alto Networks Unit 42, thereby gains persistence that survives a password reset.

The concept is this: over a phone call, the attacker poses as IT support and walks an employee through what they present as a passkey enrollment procedure. While the victim performs a bogus enrollment ceremony on a phishing page, the attacker registers their own FIDO2 key in the victim's Microsoft 365 account. The result: a strong credential, controlled by the attacker, durably anchored in the directory.

Why this persistence is so hard to dislodge

Once the attacker's passkey is registered, changing the victim's password is useless: the FIDO2 key is an independent authentication method. The attacker can sign in at will, without a password, satisfying MFA with their own key. This is T1098.005 (Account Manipulation: Device Registration), which yields persistent access to a cloud account (T1078.004).

The full chain draws on several techniques. First contact is voice phishing, T1598.004 (Phishing for Information: Spearphishing Voice). Manipulating the authentication ceremony to have enrollment approved resembles T1621 (Multi-Factor Authentication Request Generation). Okta notes the campaign has targeted organizations across several sectors since at least April 2026, and that the actor stood up a data leak site on May 31, 2026, confirming an extortion motive.

The phishing kit shows a recognizable URL sequence, with paths such as /gate, /identify, /password, /processing, and notably /passkey/register. These paths make useful indicators for web filtering and proxy detection.

The detection signal: FIDO2 method addition correlated with a risky sign-in

The most reliable detection point is not in the email or the call, invisible to logs, but in the directory itself. Entra ID logs every authentication method addition in its AuditLogs. Registering a new passkey appears there as a FIDO2 method addition event. In isolation, that event is legitimate and frequent. What makes it suspicious is its correlation with a risky sign-in: unusual geography, unknown device, IP address flagged in the SignInLogs.

Here is a Sigma rule targeting FIDO2 method addition in Entra ID audit logs:

title: FIDO2 passkey method addition in Entra ID
id: 4c8e1a90-6d2f-4b73-a1e5-9f0c3d7b2e64
status: experimental
description: >
  Detects registration of a new FIDO2 authentication method in Entra ID, to be
  correlated with a risky sign-in to surface an O-UNC-066 abuse.
references:
  - https://www.okta.com/blog/threat-intelligence/vishing-actors-target-microsoft-entra-passkey-enrollment-/
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    properties.category: 'UserManagement'
    operationName|contains:
      - 'security info'
      - 'authentication method'
    properties.targetResources|contains: 'FIDO2'
  condition: selection
falsepositives:
  - Legitimate passkey enrollment by the user, correlate with sign-in context
level: medium
tags:
  - attack.persistence
  - attack.t1098.005
  - attack.t1078.004

The correlation that turns the signal into an alert

On its own, this rule generates noise: organizations rolling out passkeys register FIDO2 methods continuously. The value comes from correlation with the SignInLogs. An effective detection ties the FIDO2 method addition to a sign-in classified as risky by Entra ID Protection within a short time window, or to a session started from a device never seen before for that account. This correlation surfaces exactly the attack pattern: someone signs in from an unusual context, then immediately enrolls a new strong key.

The organizational measures that break the campaign

Two preventive controls are decisive. First, restrict who can enroll authentication methods and from what context, via Entra ID registration policies, requiring for instance a sign-in from a managed device or trusted network to add a passkey. Second, train users on a simple fact: IT support never asks, over the phone, to run through a security enrollment procedure by following a received link. As Okta stresses, this is not a flaw in passkey cryptography, but a social engineering attack aimed at the moment of their creation.

Detecting this abuse means watching the identity directory in the right place and correlating the right signals. That is what the ThreatClaw Sigma feed provides: rules for Entra ID and cloud environments, built on audit and sign-in logs, and designed for correlation rather than the isolated alert.