Most Popular 2026 Detection – Helpdesk-Initiated FIDO2/Passkey Registration for Another User (Vishing Impersonation Takeover)
Flags FIDO2/passkey registrations initiated or facilitated by a helpdesk/support identity for another user's account, matching Okta's advisory on threat actor O-UNC-066 ('Pink' leak site) and the ShinyHunters O-UNC-037 campaign that mimicked Microsoft's passkey enrollment flow to register attacker-controlled passkeys.
Microsoft Sentinel (KQL)
