Threats · 47 days ago
Arctic Wolf says PREY-0058 has shifted into broad executive-targeted data theft and extortion, using IT help-desk vishing, adversary-in-the-middle token theft, and residential proxies against Microsoft 365 and other SaaS accounts. The group is also being mapped to UNC6671 tradecraft, with Cinder and Pink described as likely related or continuing brands.
The attack starts with a call that impersonates IT, then a fake Microsoft login page captures credentials and MFA approval as a usable session token. That token can be replayed from proxy infrastructure as the victim, letting the actor browse SharePoint and Entra ID, collect data, and extort without planting endpoint malware.
For organizations that rely on help-desk verification and MFA approval flows, the exposure sits in session trust, not on the workstation. Once a valid token exists, endpoint-centric monitoring can miss the compromise path and the later data theft that follows.
7 sources covering this story
Hackers Favor US Eastern Business Hours in M365 Phishing Campaign
KnowBe4 researchers observed a new phishing campaign leveraging Microsoft 365’s Direct Send to send malicious emails
Attackers use passkey-themed scams to hijack Microsoft 365 accounts
Microsoft says threat actors posing as IT helpdesk staff are tricking employees into phishing and device-code attacks that lead to persistent cloud access.
IT help-desk vishing tricks executives into handing over Microsoft 365 access - Help Net Security
Attackers pose as IT support in vishing calls, steal Microsoft 365 sessions, and sign in via residential proxies to steal and extort data.
Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks
PREY-0058 uses help desk vishing and AitM token theft to steal data from Microsoft 365 and other SaaS services for extortion.
Learn how attackers move from social engineering to lateral movement using legitimate tools, and how Microsoft Defender helps detect and disrupt the activity.
Threat Gang 'Springs' Vishing Attacks on Microsoft Teams Users
The "Spring Ring" operation targets users of the collaboration suite to remotely access their sessions, spread malware, and take over infrastructure.
Attackers posed as IT help desk staff on Microsoft Teams, then used vishing calls to trick employees into installing malware.
Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams
Learn how the Spring Ring campaign abuses Microsoft Teams and voice phishing to deploy malware and target enterprise domain controllers.
Part of the PlainSec briefing for 2026-09-14