IT help-desk vishing tricks executives into handing over Microsoft 365 access

1. Executive summary

Arctic Wolf is tracking a widespread data theft and extortion cluster — tracked as PREY-0058 — that compromises Microsoft 365 and other SaaS accounts through IT help-desk vishing calls, adversary-in-the-middle (AiTM) session-token theft, and sign-ins routed through residential proxy networks such as NodeMaven. The extortion side has operated under multiple labels (BlackFile, Pink, Helix, Cinder, Redact), which researchers assess may represent affiliates, rebrands, or other relationships rather than a single proven actor identity; Arctic Wolf assesses with moderate confidence that Cinder is a continuation of Pink. Targets are primarily US-based and concentrated in construction and engineering, healthcare and pharmaceuticals, real estate, finance, and professional services, with Directors, Vice Presidents, and other executive staff most frequently singled out. No CVE is involved — this is a social-engineering and token-replay campaign against identity, and the bottom-line risk for EMEA financial services is bulk exfiltration of SharePoint, OneDrive, and Exchange content followed by extortion, executed entirely with valid stolen sessions that bypass legacy MFA and many perimeter controls.

2. Regulatory framing

No specific UK NIS 2018 trigger is asserted here — the reported victim base is primarily US-based, and we do not have evidence of UK OES/RDSP victims in the source material.

3. Technical analysis & attack chain

Attribution caveat: PREY-0058 (Arctic Wolf) and UNC6671 (Google Threat Intelligence Group) have no MITRE ATT&CK profiles in our verified reference data — treat both attributions as unconfirmed. The extortion-side labels BlackFile, Pink, Helix, Cinder, and Redact likewise have no MITRE profiles; Arctic Wolf itself states these "may represent affiliates, changing brands, or other relationships rather than a single proven actor identity." Arctic Wolf assesses with moderate confidence that Cinder is a continuation of Pink, based on victim overlap between the Cinder leak site and Pink-linked phishing infrastructure. This attribution chain is single-sourced (Arctic Wolf, echoed by Help Net Security and The Hacker News reporting on the same report); verify before enforcement action.

Confirmed attack chain, per the Arctic Wolf reporting:

1. Initial access — help-desk vishing. A phone call from a person claiming to be internal IT, targeting Directors, VPs, and other executives. The caller walks the employee through what sounds like routine passkey or MFA setup. Related reporting on the Pink crew (Help Net Security, 2026-07-09) describes the same pattern: a vishing call posing as IT announcing it is "time to set up a passkey," with everything after that being theater to keep the victim occupied while the attacker finalises access.
2. Lure delivery. The attacker sends a link to an authentication page dressed up to look like it belongs to the victim's own company, often hosted as a subdomain carrying the company's name. Analysis of subdomains across the lure infrastructure revealed hundreds of entries impersonating real companies.
3. AiTM token theft. Behind the lure page is an operator-controlled adversary-in-the-middle panel, manually gated per victim, which stages the Microsoft 365 login flow, captures the password and MFA approval, and uses them to pull an authenticated session token.
4. Session replay via residential proxy. The stolen token is replayed with sign-in traffic routed through a residential proxy network — NodeMaven is named. Exfiltration-stage client IPs initially resolved to datacenter/hosting infrastructure but have more recently shifted to the same residential proxy network used for initial access.
5. Account discovery. Once inside, the attackers first open My Sign-ins, My Profile, and My Apps — enumerating account details and the applications tied to it.
6. SharePoint discovery. The attackers search SharePoint site by site and page by page, working systematically through results to map stored content before copying anything.
7. Bulk collection and exfiltration. Bulk collection from SharePoint, OneDrive, Exchange, and other SaaS providers such as Box. Exchange collection generates MailItemsAccessed events; SharePoint and OneDrive collection produces high volumes of FileAccessed and FileDownloaded events.
8. Extortion. The cluster operates as data theft and extortion; leak-site branding (BlackFile, Pink, Helix, Cinder, Redact) is used on the extortion side. The sources describe data theft and extortion — we are not characterising this as ransomware, and no encryption behaviour is reported.

Technical specifics that matter to defenders

• No CVE, no malware payload. This is pure identity abuse: valid credentials plus a relayed MFA approval produce a valid session token. Traditional AV/EDR endpoint detection will see nothing. The detectable surface is Entra/M365 audit telemetry.
• MFA bypass mechanism. The AiTM panel proxies the real Microsoft login flow, so the victim's MFA approval (push or one-time code) is relayed by the attacker. Only phishing-resistant MFA (FIDO2/passkeys bound to origin) defeats the relay.
• Infrastructure pattern. Lure subdomains impersonating real companies — hundreds observed across the infrastructure — with authentication-themed content. Newly registered authentication-themed lure infrastructure is called out as a detection opportunity.
• Proxy pattern. Residential-proxy egress (NodeMaven named) for both initial-access sign-ins and, more recently, exfiltration traffic — meaning geo/IP heuristics that trust "residential" ASN ranges will fail.

4. Mitigation & containment

P1 — within 24 hours

• Hunt for the pattern, not the hash. Query Entra ID sign-in logs and Unified Audit Log for: MailItemsAccessed bursts, high-volume FileAccessed/FileDownloaded from a single user, and sign-ins from residential-proxy or hosting ASNs (Arctic Wolf published exfiltration ASNs and residential proxy providers as IOCs — pull them from the report and match against your tenant). Focus on Director/VP/executive accounts.
• Revoke and re-issue. For any account with anomalous token replay: revoke all refresh tokens and session tokens (Entra admin center or Revoke-AzureADUserAllRefreshToken), force password reset, and re-enroll MFA from a clean device.
• Tighten Conditional Access. Per Arctic Wolf: block or challenge proxy and hosting-network traffic at sign-in. Add named-location policies that exclude anonymiser/VPN/hosting ASN ranges; treat residential-proxy egress as untrusted.

P2 — within 72 hours

• Deploy phishing-resistant MFA (FIDO2 security keys / passkeys) for executives, directors, and help-desk-adjacent staff first. Passkey-based flows cannot be relayed through a fake login page the way push approvals and OTPs can.
• Train help-desk staff on vishing. The initial-access vector is a call to the employee; the help desk is both an impersonation prop and a potential verification channel. Institute a callback procedure: any MFA/passkey reset or enrollment request initiated by inbound contact is verified by calling back the employee's number of record.
• Reduce SharePoint blast radius. Cut down how much a single SharePoint account can reach — review site-level permissions, prune legacy sharing links, and constrain per-user access so one compromised executive token cannot enumerate the whole estate.

P3 — within 7 days

• Instrument the detection opportunities Arctic Wolf names: anomalous residential-proxy token replay, SharePoint discovery and bulk access, mailbox harvesting, and newly registered authentication-themed lure infrastructure (monitor newly observed subdomains of lookalike domains referencing your brand).
• Review SaaS beyond Microsoft. Box and other SaaS providers are named exfiltration targets; confirm SaaS audit logging (where licensed) is enabled and monitored, not just M365.
• Table-top the extortion path. Confirm your Art. 18 classification criteria and Art. 19 reporting workflow can execute within prescribed timelines if bulk exfiltration is confirmed.

5. Indicators of compromise

Arctic Wolf states it published IOCs — lure domains, exfiltration ASNs, and residential proxy providers tied to sign-in activity — but the specific values are not reproduced in the source material provided to us. We will not fabricate them. Retrieve the IOC set directly from the Arctic Wolf report and match against tenant logs.

Behavioural indicators (from the source reporting):

6. Detection

The sources provide log-event identifiers and behavioural patterns suitable for a Sigma rule. No distinctive file strings, mutexes, or command-line artefacts exist (no malware payload), so no YARA rule is applicable.

title: PREY-0058 Pattern - M365 Bulk Collection Following AiTM Token Theft
id: 7c3f1a2e-9b4d-4e58-a6f1-0d8e2b9c4a77
status: experimental
description: >
  Detects the post-compromise collection pattern attributed to PREY-0058:
  high-volume SharePoint/OneDrive file access and download, and Exchange
  mailbox access bursts, characteristic of bulk exfiltration following
  AiTM session-token theft. Tune thresholds to your tenant baseline.
  Reference: Arctic Wolf via Help Net Security, 2026-09-08.
references:

  - https://www.helpnetsecurity.com/2026/09/08/vishing-microsoft-365-data-theft-extortion/
author: Adverse Trace
date: 2026-09-08
logsource:
  product: microsoft365
  service: audit
detection:
  selection_sharepoint:
    Operation:

      - FileAccessed
      - FileDownloaded
    condition_threshold:
      field: UserId
      threshold: 100
      timeframe: 1h
  selection_exchange:
    Operation: MailItemsAccessed
    condition_threshold:
      field: UserId
      threshold: 100
      timeframe: 1h
  filter_trusted_locations:
    ClientIP|ipfield:

      - trusted_named_location_range_placeholder
  condition: 1 of selection_* and not 1 of filter_*
falsepositives:

  - Legitimate bulk migration or eDiscovery activity
  - Approved data-export workflows
  - Backup/sync clients generating FileAccessed volume
level: high

Operational notes: the ClientIP filter must be populated with your tenant's trusted named-location ranges; the residual signal is anomalous-IP bulk access, which is the pattern Arctic Wolf describes (residential proxy or hosting ASN egress). Correlate with Entra sign-in logs for token replay from anomalous ASNs and with any help-desk ticket for MFA/passkey resets on the same user in the preceding 24–48 hours.

7. Sources

• Help Net Security — IT help-desk vishing tricks executives into handing over Microsoft 365 access — https://www.helpnetsecurity.com/2026/09/08/vishing-microsoft-365-data-theft-extortion/ — 2026-09-08
• The Hacker News — Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks — https://thehackernews.com/2026/09/microsoft-365-attackers-use-help-desk.html — 2026-09
• Help Net Security — Extortion crew hijacks Microsoft 365 accounts via fake passkey setup — https://www.helpnetsecurity.com/2026/07/09/microsoft-365-fake-passkey-setup-enrollment/ — 2026-07-09

8. Adverse Trace position

This is a high-impact, low-technical-barrier campaign: no CVE to patch, no malware to signature — the attacker's entire capability rests on a phone call, a convincing subdomain, a relayed MFA approval, and a valid session token replayed from residential proxy infrastructure. Severity for EMEA financial services is high despite the absence of a vulnerability, because the exfiltration target is exactly what regulators and extortionists both want — executive mailboxes and document stores — and because residential-proxy egress defeats naive geo-trust heuristics. Attribution is unconfirmed: PREY-0058, UNC6671, and the extortion brands (BlackFile, Pink, Helix, Cinder, Redact) have no MITRE ATT&CK profiles in our verified data, and the entire technical picture is single-sourced from Arctic Wolf's reporting — treat the IOC set the same way until independently corroborated, and verify before enforcement. The finance sector is explicitly named among the targeted industries, so we assess direct exposure as credible even though reported victims are primarily US-based. Next steps: we will pull the Arctic Wolf IOC set (lure domains, exfiltration ASNs, residential proxy providers) and push a client-specific hunt package for Entra/M365 tenants; we will monitor for corroboration of the PREY-0058/UNC6671 relationship and for any EMEA victim reporting that would sharpen the UK NIS and DORA reporting picture.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.