IT help-desk vishing tricks executives into handing over Microsoft 365 access
Arctic Wolf tracks PREY-0058 (linked to UNC6671), a vishing campaign stealing Microsoft 365 session tokens via AiTM panels for SaaS data theft and extortion.
68
Threat actor
PREY-0058
- Mentions · 7d0
- Mentions · 30d0
- All mentions3
- First seenSep 7, 2026
- Last mentionedSep 8, 2026
Timeline
3 articles · newest firstIT Help Desk Impersonation Lets Hackers Bypass MFA
Arctic Wolf tracks PREY-0058 posing as IT help desk to steal Microsoft 365 sessions via AiTM panels, then extorting executives after SaaS data theft.
72
Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks
Arctic Wolf tracks PREY-0058, a vishing and AitM token-theft crew targeting Microsoft 365 executives for data theft and extortion.
76
Appears with
- OneDriveproduct · 3
- Exchangeproduct · 3
- Arctic Wolfvendor · 3
- Microsoft 365product · 3
- SharePointproduct · 3
- Boxproduct · 2
- UNC6671threat actor · 2
- Entra IDproduct · 2
- Googleorganization · 2
- NodeMavenvendor · 2
- Microsoftvendor · 2
- Mandiantvendor · 1
- Cinderthreat actor · 1
- Arctic Wolforganization · 1
- Mandiantorganization · 1
- Pinkthreat actor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.