Hackers Use Fake Microsoft Entra Passkey Enrollment to Gain Microsoft 365 Access
O-UNC-066 uses vishing and a live phishing kit to trick Microsoft 365 users into enrolling attacker-controlled Entra passkeys for account access.
More info