A cyber extortion group calling itself Pink has been observed targeting Microsoft 365\u2019s passkey enrolment process in order to gain access to victim networks.<\/p>\n
According to access management and security firm Okta, the hackers are using a panel-controlled phishing kit capable of impersonating a victim organisation\u2019s Microsoft Entra ID login pages in real time.<\/p>\n
\n You\u2019re out of free articles for this month <\/p>\n
<\/p>\n
\u201cThe threat actor registers domains that incorporate the word passkey as part of a voice-enabled phishing (\u2018vishing\u2019) scheme. The threat actor then calls targeted users on the phone in an attempt to persuade them that they need to register a new passkey,\u201d Okta said in a recent blog post<\/a>.<\/p>\n
<\/p>\n \u201cUsers are directed to a phishing kit that closely mimics the Microsoft passkey enrollment process. It appears engineered to convince a targeted user they are in the process of enrolling a passkey with Microsoft, while the threat actor simultaneously registers their own passkey in the targeted user\u2019s Microsoft account.\u201d<\/p>\n
<\/p>\n What makes the process even more likely to succeed is that it not only mimics a legitimate-seeming environment \u2013 complete with Microsoft branding and that of the organisation being targeted \u2013 but it\u2019s not unlike Microsoft\u2019s own recent passkey registration activities, which began reminding users in May to enrol passkeys at sign-in.<\/p>\n
<\/p>\n \u201cThreat actors have used this well-intentioned security upgrade as a pretext for abusing the enrollment process to further their objectives,\u201d Okta said.<\/p>\n
<\/p>\n As to what those objectives are, the hackers themselves outline their motives on their darknet leak site.<\/p>\n
<\/p>\n \u201cWe are a financially motivated group. Security, as you are undoubtedly aware, is an expensive undertaking, particularly when it has been neglected for some time,\u201d Pink said.<\/p>\n
<\/p>\n \u201cOur only goal is profit, and that is our only motivation. We know what your data is worth, and we expect to get our value out of it.\u201d<\/p>\n
<\/p>\n Okta has observed the hackers using several domains to create their targeted subdomains, including:<\/p>\n
So if a victim were named \u201cExampleEntity\u201d, the malicious subdomain would read \u201cexampleentity[.]setpasskey[.]com\u201d. In addition, the sectors being targeted are in the food and beverage, technology, healthcare, automotive, construction, and aviation industries, Okta said.<\/p>\n
<\/p>\n
\n
\nassignpasskey[.]com (2026-06-14, Internet Domain Service BS Corp., DDoS-Guard)
\ndeploypasskey[.]com (2026-04-21, Tucows, DDoS-Guard)
\npasskeydeploy[.]com (2026-04-23, Internet Domain Service BS Corp, DDoS-Guard)
\npasskeyadd[.]com (2026-05-08, Tucows, DDoS-Guard)
\nsetpasskey[.]com (2026-05-23, IQWeb FZ-LLC)
\n
<\/p>\n