PREY-0058 phones executives to harvest Microsoft 365 session tokens
Arctic Wolf says the cluster it tracks as PREY-0058 deploys no malware at all. A call from fake IT leads to a proxied login page, and the stolen session token comes back from inside the victim's own ASN.
The Watch · Security desk
What happened
- Arctic Wolf's PREY-0058 cluster is working Microsoft 365 and other SaaS tenants by phoning staff while posing as internal IT, with directors and vice presidents as the main marks.
- The lure URLs follow the pattern <victim organization>.<lure domain>, and Arctic Wolf published nine such domains plus hundreds of subdomains impersonating real companies.
- The operator-controlled login page harvests the password and the MFA approval, which yields an authenticated Microsoft 365 session token.
- Operators enumerate SharePoint and Entra ID, then collect en masse from SharePoint, OneDrive, Exchange and Box before sending the extortion demand.
- Arctic Wolf recorded no endpoint malware and no network-based lateral movement anywhere in the chain.
Why it matters
- What it limits constraint Replay through NodeMaven and other proxies resolving to the victim's own geolocation and ASN removes the location signal that most Conditional Access rules lean on, so the remaining levers are device binding and session lifetime, and both cost the targeted executives convenience.
- Who's exposed exposure Picking directors and VPs means the token opens exactly the mailboxes and document libraries worth extorting, so per-user data scope in SharePoint is the only control that still caps the loss after the session is stolen.
- What doesn't add up contradiction Arctic Wolf ties PREY-0058 to Mandiant's UNC6671 and calls Cinder a likely continuation of Pink, while Google says these labels cover affiliates and splinter crews sharing one phishing kit; scoping the threat by group name will understate how many crews can run the same play.
- What it sets up precedent Extortion that never drops a file leaves endpoint-centred security programs with nothing in the attack path to detect, and pushes the detection budget toward identity and SaaS audit telemetry that many tenants have not tuned.
Next story · Security · Oct 1
TA419 courts AI policy experts before phishing their cloud accountsConfirmed7 publishers
The lure domains name the remedy. Four of the nine Arctic Wolf published contain the string passkey, three contain mfa, and two contain sso [4][18]. The pretext follows from that vocabulary: IT is enrolling your passkey, sign in here to register it. What the proxied login actually takes is the password and the MFA approval, which together yield an authenticated session token [5]. Phishing-resistant enrolment is the control that empties that pocket [13], and the rollout delivering it is the same errand the caller claims to be running [3].
Direction matters when picking the countermeasure. In Arctic Wolf's account the calls run outward, with operators posing as internal IT to directors and vice presidents [3][2], and nothing in that account describes operators phoning a service desk to get an account reset [20]. A callback rule at the help desk, verifying that whoever requests a reset is who they say, therefore does not sit in this chain. The verification that does is the reverse one: the executive confirming the IT caller is real before any authentication step begins. Arctic Wolf's guidance covers training for both populations [13].
The artefacts are audit events. Early access shows up in My Signins, My Profile and My Apps, which expose account details and the applications available to the victim [7]. Discovery then moves against SharePoint and Entra ID, with SearchQueryPerformed events carrying contentclass:STS_Site and contentclass:STS_Web plus wildcard searches using indexdocid to page through results [8]. Arctic Wolf's detection advice points at the same layer: residential-proxy token replay, SharePoint discovery and bulk access, mailbox harvesting, and newly registered authentication-themed lure infrastructure [15].
What the account does not carry is a first-observed date, a victim count, or an extortion figure [19]. Scoping stops at sector and geography, meaning US organizations concentrated in construction and engineering, healthcare and pharmaceuticals, real estate and property management, finance, and professional services [17]. The one quantity offered is infrastructure: hundreds of subdomains impersonating real companies [16]. Those subdomains measure preparation rather than confirmed victims, and that is the ceiling on what this report can tell a defender about scale.
What to watch
- A first-observed date, victim count or extortion figure from Arctic Wolf or Mandiant, which would size the cluster rather than its infrastructure.
- Fresh registrations matching the <victim organization>.<lure domain> shape aimed at your own brand name.
- Whether Cinder leak-site postings keep overlapping Pink's victim list, since that overlap is the whole basis of the rebrand call.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence60
Perspective Coverage
3 publishers- Builder
- Builder 17%
- Operator
- Operator 75%
- Investor
- Investor 8%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Arctic Wolf tracks a data theft and extortion threat cluster as PREY-0058 that targets Microsoft 365 and other SaaS offerings through IT help desk vishing, adversary-in-the-middle token theft, and residential-proxy sign-ins.
- [2]
The activity mainly singles out directors, vice presidents, and other executive staff.
- [3]
Attack chains begin with the threat actors impersonating internal IT or help desk personnel in phone calls and directing targets to an authentication-themed URL following the pattern <victim organization>.<lure domain>.
- [4]
Arctic Wolf listed these lure domains: assignpasskey[.]com, mfaregister[.]com, nowsso[.]com, oskeysetup[.]com, oursso[.]com, passkey-mfa[.]com, passkeydeploy[.]com, registermymfa[.]com, setpasskey[.]com.
- [5]
The attacks lead to an operator-controlled adversary-in-the-middle Microsoft 365 login flow designed to harvest credentials and MFA approvals in order to obtain authenticated session tokens.
- [6]
Captured tokens are used in session replay attacks originating from proxy infrastructure such as NodeMaven and from IP addresses that resolve to the same geographical location and ASN as the victim.
- [7]
Initial sign-in activity involves applications such as My Signins, My Profile and My Apps, which reveal account details and the applications available to the victim.
- [8]
After initial access the actors perform discovery against SharePoint and Entra ID; SharePoint discovery includes SearchQueryPerformed events with contentclass:STS_Site, contentclass:STS_Web, and wildcard searches using indexdocid for pagination.
- [9]
In the final step the actors perform en masse collection and exfiltration from SharePoint, OneDrive, Exchange and Box, after which extortion demands are sent to victims.
- [10]
PREY-0058 activity involves no endpoint malware deployment and no network-based lateral movement.
- [11]
Arctic Wolf says PREY-0058 shares significant tradecraft similarities with a data extortion group that Google-owned Mandiant calls UNC6671.
- [12]
Arctic Wolf says the data extortion actor known as Cinder likely represents another rebrand or possible continuation of Pink operations, citing overlaps between organizations listed on the Cinder leak site and those connected to Pink.
- [13]
Organizations are advised to implement Conditional Access policies, deploy phishing-resistant MFA, restrict the scope of data users can reach in SharePoint, and educate employees and help desk staff about vishing risks.
- [14]
Google said early last month that the evolving labels do not correspond to a single proven actor identity, but to an amorphous set of affiliates, splinter crews, or groups using the same underlying phishing infrastructure.
- [15]
Arctic Wolf says defenders can disrupt the activity by detecting anomalous residential-proxy token replay, SharePoint discovery and bulk access, mailbox harvesting, and newly registered authentication-themed lure infrastructure.
- [16]
Analysis of subdomains across the lure infrastructure uncovered hundreds of entries impersonating real companies.
- [17]
Targets are spread across the U.S., primarily in construction and engineering, healthcare and pharmaceuticals, real estate and property management, finance, and professional services.
- [18]
Of the nine lure domains Arctic Wolf listed, four contain the string passkey, three contain mfa, and two contain sso.
- [19]
The published account of PREY-0058 gives no first-observed date, no victim count, and no extortion amount.
- [20]
The published account describes the impersonation running from operators to target users; it does not describe operators calling a victim organization's help desk to obtain an account or MFA reset.
Sources
3 independent publishers whose own reporting we read for this story.
- helpnetsecurity.comIT help-desk vishing tricks executives into handing over Microsoft 365 access
1 article · September 8, 2026
- securityaffairs.comIT Help Desk Impersonation Lets Hackers Bypass MFA
1 article · September 8, 2026
- thehackernews.comFake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks
1 article · September 7, 2026
Topics and entities
Topics
- Adversary-in-the-Middle Phishing
- Session token replay
- Data Extortion
- Microsoft 365 Security