Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks
New threat cluster PREY-0058 targets executives with vishing and token theft for data extortion.
A new threat cluster, dubbed PREY-0058 by Arctic Wolf, is targeting executives with Microsoft 365 and other SaaS offerings through vishing, AitM token theft, and residential proxy sign-ins. The attacks aim to steal credentials and MFA approvals to gain session tokens, which are then used for data exfiltration from SharePoint, OneDrive, Exchange, and Box, followed by extortion demands. This campaign shows similarities to UNC6671 and potentially Cinder/Pink operations, utilizing a common phishing infrastructure.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft 365?
Get an email when a new story names Microsoft 365, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonPREY-0058 exploits human trust by impersonating IT support staff over the phone, tricking executives into approving MFA prompts and surrendering session tokens — bypassing traditional credential-based defenses entirely. Once attackers obtain valid session tokens through Adversary-in-the-Middle (AitM) techniques, they gain persistent, authenticated access to Microsoft 365, SharePoint, OneDrive, and Box without needing passwords again. Executives are high-value targets because they typically hold broad data access and are less likely to be questioned when accessing sensitive files. The subsequent extortion phase compounds the damage, turning a data breach into a financial and reputational crisis. This attack highlights that MFA alone is insufficient when social engineering manipulates users into approving fraudulent authentication requests.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — assignpasskey[.]com
- domain — mfaregister[.]com
- domain — nowsso[.]com
- domain — oskeysetup[.]com
- domain — oursso[.]com
- domain — passkey-mfa[.]com
- domain — passkeydeploy[.]com
- domain — registermymfa[.]com
- domain — setpasskey[.]com