Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks
Summary: Arctic Wolf disclosed a data theft and extortion cluster it tracks as PREY-0058 that impersonates internal IT or help desk staff by phone, directing executives to authentication-themed lure URLs that feed an adversary-in-the-middle Microsoft 365 login flow to harvest credentials and MFA approvals. The captured session tokens are replayed from residential proxy infrastructure such as NodeMaven, followed by SharePoint and Entra ID discovery and bulk exfiltration from SharePoint, OneDrive, Exchange, and Box before extortion demands are sent, with no endpoint malware or lateral movement involved.
What you should know: The targets are directors, vice presidents, and other executives across U.S. construction, healthcare, finance, real estate, and professional services, and the operators need no malware at all - a single harvested session token replayed from a residential proxy in the victim's own geography and ASN is enough to reach SharePoint, OneDrive, Exchange, and Box.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026