A $10,000 phishing kit now plants fake passkeys to keep breaking into your accounts

Passkeys are the password-replacement login method the security industry has been pushing as phishing-resistant. Instead of a string the user types, a passkey is a cryptographic key pair bound to a domain, with the private half stored on the device or in a synced password manager. Phishing sites can't read the key because the browser checks the origin first. That property is what a $10,000 phishing kit, according to The Register, now claims to circumvent by registering the attacker's own passkey against the victim's account during a fake enrollment.

The kit is operated in near real time by a person, not run as a transparent adversary-in-the-middle proxy. Okta Threat Intelligence describes "an operator-controlled PHP panel in which a threat actor steers victims through various stages of authentication in close to real-time using a 1-second heartbeat polling mechanism." The threat actor, tracked as O-UNC-066 (the extortion brand Pink, also Unit 42's CL-CRI-1147), adapts the panel to the victim's actual MFA type: TOTP, number-matching push, or SMS OTP. When the victim believes they are enrolling their own passkey, the kit registers an attacker-controlled one against the victim's Entra ID instead. The "BIP-39 recovery phrase" prompt that follows is fake, per BleepingComputer, and exists to make the enrollment feel routine.

The practical risk is not a leaked password. It is an account the attacker can sign back into later, from any device, without re-phishing anyone. A Cornell study published on August 15, reported by TechTimes, showed that passkeys survive standard password resets; the only way to evict the rogue key is for the victim to find and delete it. That is what changes the threat model. A stolen password is a one-shot. A rogue passkey is a backdoor.

Microsoft's response, per The Hacker News: "We have applied mitigations for the reported issue involving passkey relay assertions and continue investing in security enhancements across authentication methods." Those mitigations cover the relay path, the part of the attack that depends on the panel passing authentication through. They do not fix the social engineering that gets the victim to enroll a key the attacker controls.

The pretext the kit exploits is recent. In May 2026 Microsoft made Entra passkey registration campaigns generally available; in some configurations the admin-driven "nudge" to enroll at sign-in is on by default. That nudge is the prompt the vishing call uses. Unit 42 has tracked the same cluster as UNC6671 and observed passkey-themed root domains pairing terms like "passkey," "mfa," and "sso" with action verbs (assignpasskey.com, deploypasskey.com, passkeyadd.com, setpasskey.com), with per-target subdomains hosting each victim's real branding. Targeted verticals between April and May 2026 included food and beverage, technology, healthcare, automotive, construction, and aviation for Okta's view, and mature large-scale manufacturing, real estate, healthcare, and insurance enterprises for Unit 42. Primary motive is data extortion.

The O-UNC-066 kit is one of three passkey attacks to surface in 2026. At Black Hat USA on August 5, Michael Grafnetter of SpecterOps demonstrated the "Pass-the-Passkey Family of Attacks," which chain Windows' habit of storing past YubiKey signatures in cleartext with a weakness in Entra ID's passkey validation, allowing a privileged user to be impersonated while satisfying phishing-resistant MFA. Microsoft assigned CVE-2026-34348 and shipped Windows July 2026 updates alongside the Entra-side mitigations. Unit 42 separately documented the Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key attacks against Google Password Manager in Chrome on Windows, which recover synced passkey private keys or bypass phishing-resistant MFA without breaking FIDO2 itself. Independent researcher Dirk-jan Mollema separately showed that malware already running in a signed-in Windows session can use a hardware-bound Windows Hello for Business key without re-prompting for PIN or biometric, as The Hacker News has covered.

The pattern is consistent. The phishing resistance of passkeys depends on the device or the origin check, not on the user. When a user is talked through installing a key the attacker controls, the property breaks at the install step. When stored signatures are replayable or synced vaults are recoverable, it breaks at the storage layer. When malware runs in a signed-in session, it breaks at the trust boundary between user and device.

The threat is bounded. The O-UNC-066 kit still needs a live operator on a vishing call, the Microsoft mitigations cut the relay path, and hardware-bound YubiKey flows where the private key cannot be exported still hold. What changed is the attack surface. Passkeys moved phishing from the password to the enrollment prompt, and the kit's $10,000 price tag is the first market signal that operators believe the new surface is worth paying for.