Fake IT Calls Steal Microsoft 365 Tokens, Target Executives

Estimated reading time: 5 minutes · Last updated: 7 September 2026

Arctic Wolf has flagged a threat cluster it calls PREY-0058 that uses fake IT help-desk calls to lure executives into malicious authentication pages and harvest Microsoft 365 session tokens. The attack chain combines vishing, an operator-controlled AitM Microsoft 365 login flow and token replay via residential proxies to access SharePoint, OneDrive, Exchange and other SaaS repositories. Targets are primarily senior staff in the U.S., concentrating on executives across industries such as construction and engineering; healthcare and pharmaceuticals; real estate and property management; finance; and professional services. Arctic Wolf says the operation prioritizes token theft over deploying endpoint malware, which changes both detection priorities and the mitigations defenders should apply.

Initial sign-in activity involves applications such as 'My Signins,' 'My Profile,' 'My Apps,' which reveal account details and the applications available to the victim,

Steven Campbell, Trevor Daher, Stefan Hostetler and Joshua Riccio

How the attack chain turns a phone call into Microsoft 365 session theft

The campaign starts with voice calls in which attackers pose as internal IT or help-desk staff and shepherd targets to authentication-themed URLs built on a pattern such as <victim>.<lure domain>. Once a user attempts to sign in, operators position an operator-controlled AitM Microsoft 365 login flow between the target and the real service. That flow captures credentials and multi-factor approvals and converts them into authenticated session tokens the victim no longer controls.

Those tokens are valuable because they bypass endpoint controls: with a valid token, an attacker can call APIs and access web applications as the user without deploying malware on the device. The threat actors then replay the captured sessions from proxy infrastructure — the analysis names NodeMaven as an example — and from IP addresses that resolve to the same geographic region and autonomous system as the victim, making the access look legitimate to basic location checks.

Targets, scale and the impersonation infrastructure defenders must track

Arctic Wolf reports that most victims are U.S.-based directors, vice presidents and other executives, with incidents clustered in sectors including construction and engineering; healthcare and pharmaceuticals; real estate and property management; finance; and professional services. The attackers register lure domains that mimic authentication and passkey workflows; examples flagged include assignpasskey[.]com, mfaregister[.]com and passkeydeploy[.]com.

Analysis of the lure infrastructure turned up hundreds of entries impersonating real companies, a pattern that lets the attackers craft believable pretexts for each target. The examination also ties overlaps between identities used on extortion leak sites and previously observed campaigns, with Arctic Wolf noting similarities to groups Mandiant calls UNC6671 and to actors using the Cinder and Pink labels.

What defenders can detect and the controls Arctic Wolf recommends

Because these campaigns avoid installing endpoint malware or performing lateral network movement, Arctic Wolf frames detection around identity activity and unusual access patterns. Practical signals to hunt for include anomalous residential-proxy token replay, bulk SharePoint discovery and access, mass mailbox harvesting, and sign-ins from newly registered authentication-themed lure domains.

On controls, Arctic Wolf recommends Conditional Access policies that block or step up risky sign-ins, and the adoption of phishing-resistant MFA methods so that approval prompts and passkeys cannot be trivially replayed. The guidance also includes restricting the scope of users' SharePoint access and training help-desk staff and executives to treat unsolicited authentication calls as high-risk, because the chain begins with social engineering by phone.

Why token-based extortion without malware raises different priorities

Because the actors do not deploy endpoint malware or move laterally within networks, traditional incident-response playbooks that center on host containment are less effective. Instead, Arctic Wolf advises defenders to assume compromise when tokens display abnormal discovery patterns or when large-scale exfiltration from SharePoint, OneDrive or Exchange is observed; Arctic Wolf describes those stages as occurring before extortion notices are sent.

This model also elevates identity hygiene: tightening app consent, auditing third-party token lifetimes, and monitoring service principals and OAuth authorizations become immediate priorities. Arctic Wolf says the multiplicity of names — PREY-0058, UNC6671, Cinder, Pink — points to overlapping affiliates and shared phishing infrastructure rather than a single proven actor identity, so defenders should treat sightings as part of a broader ecosystem of token-focused abuse.

How the campaign could evolve — two-sided view

The bottom line

The PREY-0058 cluster shifts the battlefield from compromised hosts to stolen session tokens, forcing defenders to make identity telemetry the first line of detection. Because attackers harvest and replay tokens from residential proxies, organisations should prioritise phishing-resistant MFA, tighten Conditional Access and audit SharePoint and Exchange access patterns. Tracking and quickly blocking newly registered authentication lures and monitoring for large-scale discovery queries are practical short-term steps. Longer term, coordinated vendor guidance and timely disclosures by affected organisations will be essential to disrupt the ecosystem of reused phishing infrastructure.

What to watch

• Watch for Arctic Wolf to publish updates to its PREY-0058 indicators and an expanded list of authentication-themed lure domains; no date has been set.
• Watch for public breach notifications from companies named on extortion sites such as Cinder that could confirm affected organizations; no date has been set.