[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flgG5BIsi6rdu703_jc0I2OLGNuAu_XQcIzMMT6cKTWM":3},{"article":4,"iocs":48,"watch_terms":69,"solutions":70,"lesson":168},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"cc3b9a72-1ec4-482a-9685-5ca4abb2049f","Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks","fake-it-calls-target-executives-in-microsoft-365-data-theft-and-extortion-attack-9c92a7","Threat hunters have disclosed details of a widespread data theft and extortion threat cluster that's targeting Microsoft 365 and other software-as-a-service (SaaS) offerings through information technology (IT) help desk vishing, adversary-in-the-middle (AitM) token theft, and residential-proxy sign-ins. The activity, which mainly singles out directors, vice presidents, and other executive staff","A new threat cluster, dubbed PREY-0058 by Arctic Wolf, is targeting executives with Microsoft 365 and other SaaS offerings through vishing, AitM token theft, and residential proxy sign-ins. The attacks aim to steal credentials and MFA approvals to gain session tokens, which are then used for data exfiltration from SharePoint, OneDrive, Exchange, and Box, followed by extortion demands. This campaign shows similarities to UNC6671 and potentially Cinder\u002FPink operations, utilizing a common phishing infrastructure.","New threat cluster PREY-0058 targets executives with vishing and token theft for data extortion.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fmicrosoft-365-attackers-use-help-desk.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjg-Zo4zgxCrVcz6-00WV2qAPHSD-av2Ed5hgRmR-2vUzkr9jVeph0NNb6gGsQfwSkFyuRfRcSsaISSpfysl_Xx5F48IM7HdBpO4F3CaVuLhk1v0a4vcH5xK_bxX6BxIjkfAjhDaNGcLG7_R9IcTjVGlFcW7y1ZV64imACHi9528LOjH1Flhk-cy9LFgrMv\u002Fs1600\u002Fphish-ms.jpg","2026-09-07T15:51:56+00:00","2026-09-07T18:00:21.58433+00:00",8,[17,20,22,24,26,29],{"name":18,"type":19},"PREY-0058","threat_actor",{"name":21,"type":19},"UNC6671",{"name":23,"type":19},"Cinder",{"name":25,"type":19},"Pink",{"name":27,"type":28},"Microsoft 365","product",{"name":30,"type":31},"SaaS","technology","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[49,53,55,57,59,61,63,65,67],{"type":50,"value":51,"context":52},"domain","assignpasskey[.]com","Lure domain used in phishing attacks.",{"type":50,"value":54,"context":52},"mfaregister[.]com",{"type":50,"value":56,"context":52},"nowsso[.]com",{"type":50,"value":58,"context":52},"oskeysetup[.]com",{"type":50,"value":60,"context":52},"oursso[.]com",{"type":50,"value":62,"context":52},"passkey-mfa[.]com",{"type":50,"value":64,"context":52},"passkeydeploy[.]com",{"type":50,"value":66,"context":52},"registermymfa[.]com",{"type":50,"value":68,"context":52},"setpasskey[.]com",[27],{"controls":71,"vendors":153},[72,101,124],{"slug":73,"name":74,"problem":75,"products":76},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[77,85,93],{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":102,"name":103,"problem":104,"products":105},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[106,111,119],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":107,"product_name":108,"url":109,"description":110},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":120,"product_name":121,"url":122,"description":123},"identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":125,"name":126,"problem":127,"products":128},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[129,137,145],{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",[154,160,165],{"slug":155,"name":156,"logo_path":157,"roles":158},"arctic-wolf","Arctic Wolf","\u002Fvendor-logos\u002Farctic-wolf.png",[159],"reported_by",{"slug":161,"name":162,"logo_path":163,"roles":164},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[159],{"slug":86,"name":87,"logo_path":88,"roles":166},[167],"affected",{"slug":169,"title":170,"body":171,"framework_refs":172,"framework_notes":189},"vishing-token-theft-campaign-targets-executives-via-fake-it-calls","Vishing & Token Theft Campaign Targets Executives via Fake IT Calls","PREY-0058 exploits human trust by impersonating IT support staff over the phone, tricking executives into approving MFA prompts and surrendering session tokens — bypassing traditional credential-based defenses entirely. Once attackers obtain valid session tokens through Adversary-in-the-Middle (AitM) techniques, they gain persistent, authenticated access to Microsoft 365, SharePoint, OneDrive, and Box without needing passwords again. Executives are high-value targets because they typically hold broad data access and are less likely to be questioned when accessing sensitive files. The subsequent extortion phase compounds the damage, turning a data breach into a financial and reputational crisis. This attack highlights that MFA alone is insufficient when social engineering manipulates users into approving fraudulent authentication requests.",[173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188],"CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 6 – Access Control Management","CIS Control 14 – Security Awareness and Skills Training","CIS Control 16 – Application Software Security","NIST SP 800-63B – Digital Identity Guidelines (Phishing-Resistant AAL3 Authenticators)","NIST AC-2 – Account Management","NIST AC-17 – Remote Access","NIST SI-4 – System Monitoring","NIST IR-6 – Incident Reporting","MITRE ATT&CK T1566.004 – Phishing: Vishing","MITRE ATT&CK T1539 – Steal Web Session Cookie","MITRE ATT&CK T1567 – Exfiltration Over Web Service","GDPR Article 32 – Security of Processing","GDPR Article 33 – Notification of a Personal Data Breach","NIST CSF DE.CM-1 – Network Monitoring","NIST CSF PR.AC-7 – Strong Authentication",{}]