passkey security

The passkey security tag covers reporting on passwordless authentication in enterprise environments, with a focus on Microsoft Entra passkey enrollment and the social-engineering risks surrounding it. A recent case describes O-UNC-066, also called Pink, using vishing to persuade Microsoft 365 users to enroll attacker-controlled passkeys. The incident is presented as an attack on the enrollment process rather than a break in passkey cryptography. This makes rollout practices, helpdesk interactions, and user verification important parts of passkey security. The tag is relevant to readers tracking passwordless adoption and how attackers may target credential setup in Microsoft cloud services.