Executive Summary
Since April 2026, a threat actor tracked as O-UNC-066 (also known as the Pink extortion group) has been executing a sophisticated vishing campaign targeting organizations across sectors including aviation, healthcare, and technology. The attackers exploit a recent Microsoft update that encourages passkey enrollment, using phone calls to impersonate IT support and guide users toward malicious registration portals. Unlike typical phishing kits, this operation uses a real-time, operator-controlled PHP panel to bypass various MFA methods.
The Pink group is affiliated with the decentralized threat network 'The Com' and operates a dedicated leak site to pressure victims into paying ransoms following data exfiltration from OneDrive and SharePoint. The campaign is highly adaptive, mimicking legitimate corporate branding and using psychological distractions, such as fake BIP-39 recovery phrases, to mask the fact that the attacker is registering their own passkey on the victim's account.