Researchers at Arctic Wolf have uncovered a large-scale data theft and extortion campaign targeting users of Microsoft 365 and other cloud SaaS platforms. The threat cluster tracked as PREY-0058 uses a combination of three techniques: telephone phishing (vishing) impersonating internal IT support, interception of session tokens through an Adversary-in-the-Middle (AitM) scheme, and replay of stolen sessions via residential proxies. The primary targets are senior executives: directors, vice presidents, and other individuals with privileged access to corporate data. Organizations using Microsoft 365, SharePoint, OneDrive, Exchange, and Box are advised to immediately review their conditional access policies and implement phishing-resistant multi-factor authentication.
Attack mechanics: from phone call to exfiltration
According to Arctic Wolf data, the attack chain begins with a phone call in which the attackers pose as staff from the internal IT department or help desk. The victim is directed to a phishing URL built using the pattern <victim-organization>.<lure-domain>. The lure domains mimic MFA and passkey enrollment flows:
- assignpasskey[.]com
- mfaregister[.]com
- nowsso[.]com
- oskeysetup[.]com
- oursso[.]com
- passkey-mfa[.]com
- passkeydeploy[.]com
- registermymfa[.]com
- setpasskey[.]com
The domains listed above are only part of the rotating infrastructure. Analysis of subdomains revealed hundreds of entries impersonating real companies.
The phishing page is an operator-controlled Microsoft 365 authentication flow that operates as an AitM proxy. It intercepts not only credentials but also MFA approvals, allowing the attackers to obtain an authenticated session token. The stolen tokens are then replayed via a residential proxy infrastructure, in particular the NodeMaven service, with IP addresses chosen to match the victim’s geographic location and autonomous system (ASN). This makes it harder to detect anomalies based on geolocation.
Post-compromise actions
Once they gain access to a session, the attackers start with reconnaissance through Microsoft applications: My Signins, My Profile, My Apps, OfficeHome, and Microsoft Account Controls v2. These portals reveal information about the account and the applications available to it.
The next stage is resource discovery in SharePoint and enumeration of the Entra ID directory. In SharePoint, SearchQueryPerformed events are logged with parameters contentclass:STS_Site, contentclass:STS_Web, and wildcard queries using indexdocid for page-by-page navigation. In Entra ID, the attackers examine user flows, API connectors, identity providers, and user attributes.
The final stage is bulk data exfiltration from SharePoint, OneDrive, Exchange, and Box, after which ransom demands are sent to the victims.
Additional indicators of compromise
In addition to the lure domains, the researchers recorded the following IOCs:
- Control panel IP: 31[.]42[.]184[.]213 (infrastructure may rotate)
- User-Agent during exfiltration: Microsoft.Graph.Client/6.0.3, python-httpx/0.28.1, python-requests/2.28.1
- User-Agent during login: python-requests/2.33.1, python-requests/2.34.2
- Exchange signature: ClientAppId
9199bf20-a13f-4107-85dc-02114787ef48paired with API IDc999ed3e-27ae-4cb3-b3a2-46b056af63d3in MailItemsAccessed events
User-Agent strings by themselves are not proof of malicious activity—they should be correlated with the volume of operations, timing patterns, and source IP addresses.
Distinctive features of the campaign
The defining feature of PREY-0058 is the complete absence of malware deployment on endpoints and network lateral movement in the observed cases. The entire attack unfolds exclusively in the cloud plane: identification → data access → exfiltration. This makes the campaign almost invisible to traditional endpoint detection and response (EDR) tools and network intrusion detection systems.
It should be borne in mind that this observation applies to the analyzed cases and does not rule out the use of other methods in different incidents.
Target industries and geography
According to the researchers, the victims are concentrated mainly in the United States and represent the following sectors:
- Construction and engineering
- Healthcare and pharmaceuticals
- Real estate and property management
- Financial sector
- Professional services
The source does not provide a quantitative estimate of the number of victims.
Recommendations for protection
Arctic Wolf suggests the following set of measures to counter this threat:
- Conditional Access policies: require sign-ins only from managed or compliant devices, which blocks token replay from arbitrary hosts.
- Phishing-resistant MFA: move to FIDO2/passkey or certificate-based authentication instead of push notifications and SMS, which can be intercepted via AitM.
- Continuous Access Evaluation: allows tokens to be revoked in real time when anomalies are detected.
- Least privilege in SharePoint: limiting the volume of data available to each user reduces the potential scale of exfiltration.
- Training for staff and IT support: personnel should be aware of vishing tactics and be able to verify calls from “IT support” through independent channels.
Key detection points
For monitoring teams, it is critical to track: anomalous token replay via residential proxies, mass discovery and download requests in SharePoint, batch access to Exchange mailboxes, and the appearance of new authentication-themed domains in DNS and proxy logs.
The PREY-0058 campaign demonstrates a mature operational approach in which the entire attack is carried out through cloud identity without a single artifact on endpoints. Organizations that rely on Microsoft 365 should first and foremost implement phishing-resistant MFA and conditional access policies tied to managed devices—these two measures break the attack chain at a very early stage, rendering both token interception and subsequent replay through proxies ineffective.
