Cybersecurity threat hunters have uncovered a sophisticated data theft and extortion campaign targeting corporate executives across the United States through fraudulent IT help desk phone calls. Tracked as PREY-0058, the threat cluster relies on a combination of voice phishing, adversary-in-the-middle session token theft, and proxy-based sign-ins to breach Microsoft 365 and other software-as-a-service platforms without deploying traditional endpoint malware.
Security researchers at Arctic Wolf detailed the ongoing campaign, noting that the threat actors predominantly single out high-ranking corporate officials, including vice presidents and directors. The operation bypasses conventional perimeter defenses by exploiting human trust and hijacking authenticated sessions directly, pointing to a growing trend of identity-centric cyber attacks that circumvent traditional endpoint security controls.
Anatomy of the Vishing and Phishing Attack Chain
The attack sequence initiates when threat actors place fraudulent phone calls to targeted employees, posing as internal information technology or help desk personnel. Under the guise of routine security updates or passkey deployments, the callers direct victims to malicious authentication-themed URLs designed to mimic legitimate corporate sign-in portals. These domains utilize targeted naming conventions following the structural pattern of the victim organization combined with specific lure domains.
Flagged domains utilized in the campaign include assignpasskey.com, mfaregister.com, nowsso.com, oskeysetup.com, oursso.com, passkey-mfa.com, passkeydeploy.com, registermymfa.com, and setpasskey.com. Arctic Wolf researchers observed that subdomains across this infrastructure have been systematically generated to impersonate hundreds of real companies, providing a veneer of authenticity during the initial social engineering interaction.
Adversary-in-the-Middle and Session Token Theft Mechanisms
Once a victim navigates to the fraudulent URL, the connection routes through an operator-controlled adversary-in-the-middle infrastructure designed to intercept both primary credentials and multi-factor authentication approvals. This allows the attackers to acquire valid authenticated session tokens rather than breaking cryptographic keys directly. By capturing active sessions, the operators bypass secondary verification prompts entirely.
Following token acquisition, the threat actors execute session replay attacks using commercial proxy infrastructure such as NodeMaven. These connections are routed through IP addresses that match the geographical location and autonomous system number of the targeted user to evade anomaly detection engines. Initial post-compromise activity involves accessing endpoints such as 'My Signins,' 'My Profile,' and 'My Apps' to inventory account privileges and discover accessible cloud assets.
Discovery, Mass Data Exfiltration, and Extortion Demands
After establishing initial access, the attackers pivot to wide-scale discovery phases targeting SharePoint and Entra ID environments. According to the analysis published by researchers Steven Campbell, Trevor Daher, Stefan Hostetler, and Joshua Riccio, SharePoint discovery involves executing specific search queries with parameters such as contentclass:STS_Site and contentclass:STS_Web, alongside wildcard queries utilizing indexdocid for pagination.
The final phase of the compromise involves en masse data collection and exfiltration across multiple enterprise cloud repositories, including SharePoint, OneDrive, Exchange, and Box. Once the sensitive corporate data is harvested, the threat group issues direct extortion demands to the affected organizations. Notably, the entire kill chain executes entirely within cloud environments, avoiding the deployment of local endpoint malware or traditional network-based lateral movement techniques.
Attribution and Overlaps With Known Extortion Groups
Security analysts have linked the tradecraft of PREY-0058 to other known cybercrime operations, noting significant operational overlaps with a data extortion collective tracked by Google's Mandiant as UNC6671. Additionally, researchers suggest that the extortion actor designated as Cinder may represent a rebrand or operational continuation of previous Pink activity, based on shared targets across leak sites.
Industry experts emphasize that these shifting labels do not necessarily indicate a singular, unified criminal entity. Instead, they reflect an amorphous ecosystem of affiliated splinter crews and threat actors sharing common phishing infrastructure and deployment methodologies. The campaign's primary industry targets span critical U.S. sectors, including construction and engineering, healthcare and pharmaceuticals, real estate, finance, and professional services.
Mitigation Strategies and Defensive Recommendations
To counter the PREY-0058 threat cluster, cybersecurity authorities recommend immediate defensive hardening across cloud environments. Organizations are advised to implement strict Conditional Access policies, deploy phishing-resistant multi-factor authentication methods such as FIDO2 keys, and enforce granular access restrictions on SharePoint data repositories to limit potential blast radius.
Defenders can disrupt this activity by detecting anomalous residential-proxy token replay, SharePoint discovery and bulk access, mailbox harvesting, and newly registered authentication-themed lure infrastructure," Arctic Wolf said in their advisory, highlighting the importance of behavioral monitoring over static signature detection.
