Hackers Pose as IT Staff to Steal Data From Microsoft 365 Executives

Cybercriminals are targeting senior executives at Microsoft 365 organizations through fake help desk calls that lead to credential theft and data extortion, according to a report published by Arctic Wolf. The widespread campaign primarily focuses on directors, vice presidents, and other executive personnel at companies using Microsoft 365 and other cloud software platforms. Researchers are tracking the operation as PREY-0058, and say it shares considerable technical overlap with a data extortion group that Mandiant calls UNC6671.

The attack sequence begins with threat actors impersonating internal IT or help desk workers in phone calls to targets, then directing them to fake authentication websites that follow the pattern: victim organization.lure domain. Identified lure domains include assignpasskey[.]com, mfaregister[.]com, nowsso[.]com, oskeysetup[.]com, oursso[.]com, passkey-mfa[.]com, passkeydeploy[.]com, registermymfa[.]com, and setpasskey[.]com. These sites lead victims through an attacker-controlled Microsoft 365 login flow engineered to capture login credentials and multi-factor authentication approvals, granting access to authenticated session tokens. The stolen tokens are then used in session replay attacks launched from proxy services like NodeMaven and IP addresses that match the victim's geographical location and autonomous system number. Investigation of subdomains across the phishing infrastructure revealed hundreds of entries mimicking real companies, with victims concentrated in the U.S. across construction and engineering, healthcare and pharmaceuticals, real estate and property management, finance, and professional services sectors.

"Initial sign-in activity involves applications such as 'My Signins,' 'My Profile,' 'My Apps,' which reveal account details and the applications available to the victim," researchers Steven Campbell, Trevor Daher, Stefan Hostetler, and Joshua Riccio wrote in the analysis. Following initial access, attackers conduct reconnaissance against SharePoint and Entra ID through SearchQueryPerformed events with contentclass:STS_Site, contentclass:STS_Web, and wildcard searches using indexdocid for pagination, the report states. The final stage involves mass collection and removal of data from SharePoint, OneDrive, Exchange, and Box, followed by extortion demands sent to victims. One distinctive element of PREY-0058 is the complete absence of endpoint malware installation or network-based lateral movement, the researchers noted.

The technique succeeds because it exploits human trust in internal support channels rather than traditional software vulnerabilities, allowing attackers to bypass many conventional security measures. By using residential proxies and matching victim IP locations, the campaign evades detection systems designed to flag logins from unfamiliar geographic areas or suspicious networks. The focus on session token theft rather than persistent password access means that even organizations with strong password policies remain vulnerable once tokens are captured. Arctic Wolf recommends that organizations deploy Conditional Access policies, implement phishing-resistant multi-factor authentication, limit the scope of data users can access in SharePoint, and train both employees and help desk personnel about vishing threats. "Defenders can disrupt this activity by detecting anomalous residential-proxy token replay, SharePoint discovery and bulk access, mailbox harvesting, and newly registered authentication-themed lure infrastructure," the report concludes. The campaign underscores a shift toward social engineering attacks that exploit the operational gaps between user education and real-world impersonation tactics, requiring security teams to rethink how authentication trust is established beyond technical controls alone.