Entra passkey enrollment vishing targets Microsoft 365 users

Intelligence Summary

A threat actor is using voice-based vishing to trick Microsoft 365 users into enrolling a new Entra passkey. The calls pose as fake security requests and direct victims to complete passkey setup. This can enable account takeover if attackers capture the enrollment flow or redirect authentication. Organizations using Entra ID and Microsoft 365 are at risk, especially users who follow instructions during unexpected calls. Users should verify passkey enrollment prompts via official channels and train helpdesk-resistant verification for account recovery actions.

Recommended Action

Review affected assets, schedule urgent remediation, and monitor related indicators.

Topics