Fake IT Calls Steal Microsoft 365 Data from Executives — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Arctic Wolf tracked the activity as PREY-0058, noting it shares significant tradecraft overlap with Mandiant's UNC6671, while the Cinder threat actor likely represents a rebrand or continuation of Pink operations based on leak-site overlaps.
- PREY-0058 operators begin attacks by impersonating internal IT or help desk personnel in phone calls and directing executives to authentication-themed lure domains such as assignpasskey[.]com, mfaregister[.]com, and passkeydeploy[.]com.
- The attack chain funnels victims through an operator-controlled adversary-in-the-middle Microsoft 365 login flow that harvests credentials and MFA approvals, then leverages the captured session tokens for replay attacks via residential-proxy infrastructure including NodeMaven from IP addresses matching the victim's geography and ASN.
- Following access, attackers perform discovery against SharePoint and Entra ID—using SearchQueryPerformed events with contentclass:STS_Site and indexdocid pagination—before bulk-exfiltrating data from SharePoint, OneDrive, Exchange, and Box and issuing extortion demands.
- Notably absent from the tradecraft is any endpoint malware deployment or network-based lateral movement, and hundreds of lure subdomains have been found impersonating real companies across U.S. construction and engineering, healthcare and pharmaceuticals, real estate, finance, and professional services.
- Arctic Wolf researchers Steven Campbell, Trevor Daher, Stefan Hostetler, and Joshua Riccio recommended Conditional Access policies, phishing-resistant MFA, restricted SharePoint data access scopes, and help-desk vishing training as mitigations against the campaign.
Why it matters: The campaign targets directors, VPs, and other C-suite staff whose accounts typically have the broadest access to SharePoint, OneDrive, Exchange, and Box—the combination that lets attackers skip lateral movement entirely and go straight to bulk exfiltration, leaving defenders to detect the theft only after extortion emails arrive.
Ask SkimNews
