Arctic Wolf Details PREY-0058 Vishing Campaign Targeting Microsoft 365 and SaaS Data

Summary

Arctic Wolf describes PREY-0058, a vishing and AiTM campaign that bypasses MFA to access Microsoft 365 and SaaS data, then extorts victims without encrypting files. It details the intrusion sequence and defensive measures.

Key points

Arctic Wolf says PREY-0058 actors impersonate IT or Help Desk staff by phone or text to target senior employees and obtain credentials and MFA tokens through AiTM phishing.
The reported sequence includes account reconnaissance, Exchange Online mailbox harvesting, SharePoint enumeration, and rapid bulk file access and exfiltration.
Arctic Wolf identifies abnormal Exchange Online API activity and high volumes of MailItemsAccessed, AttachmentAccessed, SearchQueryPerformed, and file-access events as observed behaviors.
The actors reportedly use static residential NodeMaven proxies and have shifted from Python user agents to spoofed Chrome strings.
The campaign is described as data theft followed by extortion through TOX, with a 72-hour response window and threats to expose data; Arctic Wolf says actors do not encrypt or destroy data.
Arctic Wolf recommends phishing-resistant MFA, managed-device access controls, restricting residential proxy traffic, least-privilege SharePoint permissions, and Microsoft Purview DLP thresholds.

Article Details

Attack Vectors: Actors impersonate IT or Help Desk staff in targeted phone calls or texts to persuade users to access victim-specific adversary-in-the-middle phishing subdomains.
The phishing portal captures Microsoft 365 or Okta/Duo credentials and MFA tokens, enabling unauthorized access without exploiting a software vulnerability.
After gaining access, actors inspect compromised accounts, sometimes initiate password resets or MFA registrations, harvest Exchange Online mail, enumerate SharePoint sites and documents, and rapidly retrieve files.
The campaign uses static residential proxy infrastructure to blend sign-ins into legitimate activity; extortion messages are then sent to victim executives through TOX with a 72-hour response window.
Defensive Notes: Train executives and other high-risk users to recognize vishing, and require unexpected support requests to be verified through an independent trusted channel.
Use phishing-resistant MFA, such as FIDO2 hardware security keys or certificate-based authentication, and require sign-ins from compliant, registered, hybrid-joined, or managed devices.
Restrict access from known residential or anonymization proxy networks, including NodeMaven infrastructure.
Apply least-privilege permissions to SharePoint sites, libraries, and folders, and configure Microsoft Purview DLP rules to alert on or block high-volume file downloads.
Monitor for suspicious identity activity, cloud reconnaissance, abnormal Exchange Online API access, broad SharePoint queries, and bulk file retrieval.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`assignpasskey[.]com`	AiTM phishing domain lure identified by Arctic Wolf.
DOMAIN	`mfaregister[.]com`	AiTM phishing domain lure identified by Arctic Wolf.
DOMAIN	`oskey[.]com`	AiTM phishing domain lure identified by Arctic Wolf.
DOMAIN	`oskeyconnect[.]com`	AiTM phishing domain lure identified by Arctic Wolf.
DOMAIN	`oskeysetup[.]com`	AiTM phishing domain lure identified by Arctic Wolf.
DOMAIN	`passkey-mfa[.]com`	AiTM phishing domain lure identified by Arctic Wolf.
DOMAIN	`registermymfa[.]com`	AiTM phishing domain lure identified by Arctic Wolf.
DOMAIN	`secure-passkey[.]com`	AiTM phishing domain lure identified by Arctic Wolf.
DOMAIN	`setpasskey[.]com`	AiTM phishing domain lure identified by Arctic Wolf.