Executive Summary
The threat actor O-UNC-066 (also known as CL-CRI-1147 and affiliated with 'The Com' collective) is conducting a sophisticated vishing campaign targeting Microsoft 365 users. The attackers call victims to persuade them to enroll a new Entra passkey, directing them to a highly convincing phishing kit that mimics the legitimate Microsoft enrollment process. In reality, the kit facilitates the registration of an attacker-controlled passkey to the victim's account, providing persistent, phishing-resistant access for data extortion.
The attack chain involves an operator-controlled PHP panel that allows real-time adaptation to the victim's specific MFA requirements, including SMS OTP, TOTP, and push notifications. While the victim is distracted by a fake 'recovery key' generation process involving a 12-word mnemonic phrase, the attacker completes the backend enrollment of their own passkey. This campaign has impacted multiple sectors including aviation, technology, healthcare, and automotive.
This activity is particularly dangerous as it exploits the very security upgrade process (transitioning to passkeys) that organizations are currently promoting. The involvement of 'The Com' affiliates like Scattered Spider and LAPSUS$ suggests a high level of technical proficiency and a primary focus on data theft and extortion.