Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks
Arctic Wolf tracks PREY-0058, a vishing and AitM token-theft crew targeting Microsoft 365 executives for data theft and extortion.
Arctic Wolf disclosed a widespread data theft and extortion cluster, PREY-0058, which overlaps with Mandiant's UNC6671 and possibly the Pink/Cinder extortion groups. Attackers impersonate IT help desk staff by phone, direct executives to authentication-themed lure domains, and run adversary-in-the-middle Microsoft 365 logins to harvest credentials, MFA approvals, and session tokens replayed via residential proxies such as NodeMaven. After access, they run discovery in SharePoint and Entra ID, then bulk-exfiltrate data from SharePoint, OneDrive, Exchange, and Box before sending extortion demands. Targets are primarily US construction, healthcare, real estate, finance, and professional services organizations.
- Uses help desk vishing and AitM login pages on domains like mfaregister[.]com and nowsso[.]com
- Replays stolen tokens from residential proxies geo-matched to victims; no endpoint malware or lateral movement
- Bulk collection from SharePoint, OneDrive, Exchange, and Box followed by extortion demands
- Tradecraft overlaps with Mandiant-tracked UNC6671 and the Cinder leak site linked to Pink operations
- Defenders urged to deploy phishing-resistant MFA, Conditional Access, and SharePoint data scoping
- Vendors
- Arctic WolfMandiantMicrosoft
- Organizations
- Arctic WolfMandiantGoogle
- Countries
- United States
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | assignpasskey.com | the lure domains flagged by Arctic Wolf are listed below - assignpasskey[.]com mfaregister[.]com nowsso[.]com oskeysetup[.]com oursso[.] |
| domain | mfaregister.com | agged by Arctic Wolf are listed below - assignpasskey[.]com mfaregister[.]com nowsso[.]com oskeysetup[.]com oursso[.]com passkey-mfa[.] |
| domain | nowsso.com | lf are listed below - assignpasskey[.]com mfaregister[.]com nowsso[.]com oskeysetup[.]com oursso[.]com passkey-mfa[.]com passkeyde |
| domain | oskeysetup.com | below - assignpasskey[.]com mfaregister[.]com nowsso[.]com oskeysetup[.]com oursso[.]com passkey-mfa[.]com passkeydeploy[.]com regist |
| domain | oursso.com | sskey[.]com mfaregister[.]com nowsso[.]com oskeysetup[.]com oursso[.]com passkey-mfa[.]com passkeydeploy[.]com registermymfa[.]com |
| domain | passkeydeploy.com | owsso[.]com oskeysetup[.]com oursso[.]com passkey-mfa[.]com passkeydeploy[.]com registermymfa[.]com setpasskey[.]com The attacks lead to |
| domain | passkey-mfa.com | faregister[.]com nowsso[.]com oskeysetup[.]com oursso[.]com passkey-mfa[.]com passkeydeploy[.]com registermymfa[.]com setpasskey[.]com |
| domain | registermymfa.com | up[.]com oursso[.]com passkey-mfa[.]com passkeydeploy[.]com registermymfa[.]com setpasskey[.]com The attacks lead to an operator-controll |
| domain | setpasskey.com | m passkey-mfa[.]com passkeydeploy[.]com registermymfa[.]com setpasskey[.]com The attacks lead to an operator-controlled AitM Microsoft |
From the original article
2 min read at thehackernews.com
Threat hunters have disclosed details of a widespread data theft and extortion threat cluster that's targeting Microsoft 365 and other software-as-a-service (SaaS) offerings through information technology (IT) help desk vishing, adversary-in-the-middle (AitM) token theft, and residential-proxy sign-ins. The activity, which mainly singles out directors, vice presidents, and other executive staff
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.