Fake IT help desks push M365 data theft

Scattered threat actors are running a sprawling data-theft and extortion campaign aimed squarely at corporate leadership, leaning on fake IT help desk phone calls to walk executives through Microsoft 365 login pages that steal their credentials and session tokens. Security firm Arctic Wolf has been tracking the activity, which it calls PREY-0058, and says the attacks are hitting directors, vice presidents, and other executive staff across a range of industries, with victims concentrated in the United States.

Arctic Wolf's analysis ties the operation to a wider ecosystem of phishing infrastructure, describing overlaps with at least two other tracked groups and noting that the same lure domains have been used to impersonate hundreds of real companies. The campaign's endgame, according to the firm, is mass data exfiltration from SharePoint, OneDrive, Exchange, and Box — followed by extortion demands sent directly to the victims.

Help desk phone calls as a first step

The attack chain begins not with an email but with a phone call. Threat actors pose as internal IT or help desk personnel and direct their targets to an authentication-themed URL that matches a predictable pattern: the victim's organization name followed by one of several lure domains. Among the domains Arctic Wolf flagged are assignpasskey[.]com, mfaregister[.]com, nowsso[.]com, oskeysetup[.]com, oursso[.]com, passkey-mfa[.]com, passkeydeploy[.]com, registermymfa[.]com, and setpasskey[.]com.

The lure domains are constructed to look like legitimate authentication or MFA registration portals, which fits with the social-engineering narrative the callers use. Requests to register a passkey or update MFA settings are plausible enough that executives, who may be less familiar with the nuances of identity infrastructure, can be talked through the process over the phone while the attackers harvest everything they type.

AitM login flow harvests tokens

Once a victim lands on the lure page, the attackers run an adversary-in-the-middle (AitM) Microsoft 365 login flow designed to capture credentials and multi-factor authentication approvals. The technique lets the operators obtain authenticated session tokens without needing to defeat MFA outright — they simply relay the approval the victim provides.

Captured tokens are then replayed from proxy infrastructure, with Arctic Wolf naming NodeMaven specifically, and from IP addresses that resolve to the same geographical location and autonomous system number as the victim. That geographic alignment is deliberate: a session replay coming from the victim's own region and network provider looks far less anomalous to security tools than one originating from a foreign data center.

Reconnaissance inside the tenant

After gaining access, the attackers take a measured approach to exploring what they have stolen into. Arctic Wolf's researchers detailed the initial sign-in activity as involving applications such as 'My Signins,' 'My Profile,' and 'My Apps,' which reveal account details and the applications available to the victim.

After initial access, the threat actors perform discovery techniques against SharePoint and Entra ID. SharePoint discovery includes SearchQueryPerformed events with contentclass:STS_Site, contentclass:STS_Web, and wildcard searches using indexdocid for pagination.

— Researchers Steven Campbell, Trevor Daher, Stefan Hostetler, and Joshua Riccio, in Arctic Wolf's analysis

That discovery phase is methodical, mapping out what data is available and where it lives before any large-scale theft begins. The focus on SharePoint and Entra ID suggests the operators know exactly which repositories in a Microsoft 365 tenant tend to hold the sensitive files worth stealing and extorting over.

Data theft, then extortion demands

The final stage of the operation involves en masse collection and exfiltration from SharePoint, OneDrive, Exchange, and Box. Only after the data has been lifted do the extortion demands go out to the victims, according to Arctic Wolf.

What sets PREY-0058 apart from many other intrusion campaigns is the absence of endpoint malware deployment or network-based lateral movement. The entire operation runs through legitimate cloud services and stolen tokens, leaving little in the way of traditional forensic artifacts on endpoint systems that defenders would typically hunt for.

Overlaps with UNC6671 and Cinder

Arctic Wolf's researchers said the tradecraft shares significant similarities with a data extortion group that Google-owned Mandiant tracks as UNC6671. The firm also drew a link between the data extortion actor known as Cinder and the group called Pink, pointing to overlaps between the organizations listed on the Cinder leak site and those connected to Pink.

Notably, Arctic Wolf cautioned that these evolving labels do not correspond to a single proven actor identity. Instead, they describe an amorphous set of affiliates, splinter crews, or groups using the same underlying phishing infrastructure — a point Google itself indicated early last month. Analysis of subdomains across the lure infrastructure has turned up hundreds of entries impersonating real companies, underlining the scale of the operation's phishing footprint.

Who is being targeted

The targets are spread across the U.S., with Arctic Wolf identifying the primary sectors as construction and engineering, healthcare and pharmaceuticals, real estate and property management, finance, and professional services. The common thread is executive-level personnel — directors, vice presidents, and other senior staff — whose accounts typically have broad access to sensitive corporate data.

That focus on execs makes sense from an extortion perspective: compromising a leader's account can expose board materials, merger discussions, financial planning, and other high-value documents that a company would be highly motivated to keep private. The volume of data accessible through a single executive's SharePoint and OneDrive accounts can dwarf what a lower-level employee could reach.

Defensive measures against the campaign

Arctic Wolf outlined a set of defensive steps for organizations looking to blunt the threat. The guidance includes implementing Conditional Access policies, deploying phishing-resistant MFA, restricting the scope of data that users have access to in SharePoint, and educating employees and help desk staff about vishing risks.

The last point is worth emphasizing — the phone call is the entry point for this entire chain, so help desk staff who can recognize and push back on suspicious calls play an outsize role in preventing the initial compromise. Technical controls alone cannot stop an executive from being talked through a fraudulent login if they believe they are speaking with their own IT department.

Why the stakes are rising for defenders

What this campaign suggests is that extortion groups are refining their playbooks to operate almost entirely inside legitimate cloud infrastructure, using stolen session tokens rather than malware to get the job done. The residential-proxy token replay technique, combined with geolocation-matched source IPs, represents a meaningful challenge to security teams who have long relied on geographic anomalies as a signal of compromise.

For organizations running Microsoft 365, the practical takeaway is that robust identity protections — phishing-resistant MFA, Conditional Access, tighter SharePoint scoping — are no longer optional extras but core defenses against a very real, active threat. The attackers' focus on executive accounts also suggests that data owners and business leaders themselves need to understand they are prime targets, and that the help desk voice on the other end of the line may not always be a colleague.