Vishing & Token Theft Campaign Targets Executives via Fake IT Calls
Written by AI from the linked story. Not reviewed by an editor. How this works
PREY-0058 exploits human trust by impersonating IT support staff over the phone, tricking executives into approving MFA prompts and surrendering session tokens — bypassing traditional credential-based defenses entirely. Once attackers obtain valid session tokens through Adversary-in-the-Middle (AitM) techniques, they gain persistent, authenticated access to Microsoft 365, SharePoint, OneDrive, and Box without needing passwords again. Executives are high-value targets because they typically hold broad data access and are less likely to be questioned when accessing sensitive files. The subsequent extortion phase compounds the damage, turning a data breach into a financial and reputational crisis. This attack highlights that MFA alone is insufficient when social engineering manipulates users into approving fraudulent authentication requests.
Tactical Insight
Immediate actions
- Train executives and their assistants to verify IT support requests through a known, out-of-band callback number before approving any MFA prompts.
- Deploy phishing-resistant MFA (e.g., FIDO2/passkeys) to eliminate approval-based MFA methods vulnerable to vishing and AitM attacks.
- Block or flag sign-ins originating from residential proxy IP ranges using Conditional Access policies in Microsoft Entra ID.
Long-term improvements
- Implement Privileged Access Workstations (PAWs) and strict Conditional Access policies that restrict executive account access to known, managed devices and locations.
- Apply least-privilege data access controls so that even compromised executive sessions cannot bulk-exfiltrate from SharePoint, OneDrive, and Exchange.
- Establish a verified IT support helpdesk protocol with unique employee callback codes to authenticate internal support staff to end users.
Detection measures
- Monitor for anomalous session token usage, including sign-ins from unexpected geographies or residential proxy ASNs following a successful MFA approval.
- Enable Microsoft 365 Defender alerts for bulk file downloads from SharePoint and OneDrive, and integrate these with your SIEM for rapid triage.
- Conduct regular threat-hunting exercises specifically looking for AitM infrastructure indicators (e.g., Evilginx-style reverse proxies) targeting your domain.