IT help-desk vishing tricks executives into handing over Microsoft 365 access
Arctic Wolf tracks PREY-0058 (linked to UNC6671), a vishing campaign stealing Microsoft 365 session tokens via AiTM panels for SaaS data theft and extortion.
68
Vendor
NodeMaven
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenSep 8, 2026
- Last mentionedSep 8, 2026
Timeline
2 articles · newest firstIT Help Desk Impersonation Lets Hackers Bypass MFA
Arctic Wolf tracks PREY-0058 posing as IT help desk to steal Microsoft 365 sessions via AiTM panels, then extorting executives after SaaS data theft.
72
Appears with
- Exchangeproduct · 2
- PREY-0058threat actor · 2
- Arctic Wolfvendor · 2
- OneDriveproduct · 2
- Boxproduct · 2
- SharePointproduct · 2
- Microsoft 365product · 2
- FIDO2product · 1
- Google Threat Intelligence Groupvendor · 1
- UNC6671threat actor · 1
- Microsoftvendor · 1
- Entra IDproduct · 1
- Googleorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.