IT Help Desk Impersonation Lets Hackers Bypass MFA
Arctic Wolf tracks PREY-0058 posing as IT help desk to steal Microsoft 365 sessions via AiTM panels, then extorting executives after SaaS data theft.
Arctic Wolf documented a threat cluster tracked as PREY-0058 that impersonates internal IT help desk staff by phone, luring Directors, VPs, and executives to authentication-themed URLs formatted as victim-organization lure domains. Adversary-in-the-middle panels intercept credentials and MFA approvals, and stolen sessions are replayed through residential proxies such as NodeMaven from IPs matching the victim's geo-location and ASN, defeating impossible-travel alerts. Attackers perform discovery against SharePoint and Entra ID, then harvest data from OneDrive, Exchange, and Box before issuing extortion demands. Defenders are advised to require managed devices, use phishing-resistant MFA like FIDO2, enable Continuous Access Evaluation, and monitor sign-ins, SharePoint SearchQueryPerformed, and MailItemsAccessed events.
- Attackers target executives by phone with organization-mimicking authentication portals to capture MFA approvals.
- Session replay via NodeMaven residential proxies matches victim geography, blinding impossible-travel detections.
- Post-access discovery spans Entra ID and SharePoint; data is drained from OneDrive, Exchange, and Box before extortion.
- Recommended mitigations include FIDO2/passkeys, managed devices for Microsoft 365, and blocking hosting/proxy networks.
- Tags
- adversary-in-the-middleextortionmfa-bypassmicrosoft-365prey-0058residential-proxiessocial-engineeringvishing
- Threat actors
- PREY-0058
From the original article
2 min read at securityaffairs.com
Attackers bypass endpoint security by posing as IT staff, stealing Microsoft 365 sessions, draining SaaS data and demanding extortion. Forget installing malware because today’s extortionists just pick up the phone instead of writing code. A widespread threat cluster tracked as PREY-0058 bypasses endpoint security entirely by targeting Microsoft 365 and SaaS environments through pure social […]
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.