PREY-0058 Uses Help Desk Vishing and Token Theft to Steal SaaS Data and Extort Victims
Summary
Arctic Wolf says PREY-0058 targets executives with help desk vishing and AitM token theft, then uses residential proxies to access SaaS accounts, collect data and issue extortion demands. Researchers note overlaps with UNC6671 and possible Cinder/Pink operations.
Key points
- Attackers impersonate internal IT or help desk staff by phone and direct executives to authentication-themed lure pages.
- An AitM Microsoft 365 login flow captures credentials, MFA approvals and authenticated session tokens.
- Attackers replay captured tokens through residential proxies, including infrastructure such as NodeMaven.
- After account discovery, attackers collect data from SharePoint, OneDrive, Exchange and Box before sending extortion demands.
- Arctic Wolf tracks the activity as PREY-0058 and reports tradecraft similarities with UNC6671; links between Cinder and Pink are described as possible, not proven.
- The activity reportedly lacks endpoint malware deployment and network-based lateral movement.
- Recommended defenses include phishing-resistant MFA, Conditional Access, limiting SharePoint data access, and training help desk staff and employees about vishing.
Article Details
- Event Type
- Data theft and extortion campaign targeting Microsoft 365 and other SaaS platforms through help desk vishing and adversary-in-the-middle token theft.
- Impact
- Attackers target executives, steal credentials and authenticated session tokens, access and exfiltrate data from SharePoint, OneDrive, Exchange, and Box, and issue extortion demands. The article reports no endpoint malware deployment or network-based lateral movement.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | assignpasskey[.]com | Authentication-themed lure domain identified by Arctic Wolf as part of the campaign's credential- and MFA-theft infrastructure. |
| DOMAIN | mfaregister[.]com | Authentication-themed lure domain identified by Arctic Wolf as part of the campaign's credential- and MFA-theft infrastructure. |
| DOMAIN | nowsso[.]com | Authentication-themed lure domain identified by Arctic Wolf as part of the campaign's credential- and MFA-theft infrastructure. |
| DOMAIN | oskeysetup[.]com | Authentication-themed lure domain identified by Arctic Wolf as part of the campaign's credential- and MFA-theft infrastructure. |
| DOMAIN | oursso[.]com | Authentication-themed lure domain identified by Arctic Wolf as part of the campaign's credential- and MFA-theft infrastructure. |
| DOMAIN | passkey-mfa[.]com | Authentication-themed lure domain identified by Arctic Wolf as part of the campaign's credential- and MFA-theft infrastructure. |
| DOMAIN | passkeydeploy[.]com | Authentication-themed lure domain identified by Arctic Wolf as part of the campaign's credential- and MFA-theft infrastructure. |
| DOMAIN | registermymfa[.]com | Authentication-themed lure domain identified by Arctic Wolf as part of the campaign's credential- and MFA-theft infrastructure. |
| DOMAIN | setpasskey[.]com | Authentication-themed lure domain identified by Arctic Wolf as part of the campaign's credential- and MFA-theft infrastructure. |
MITRE ATT&CK
T1114 · Email CollectionThe article reports mailbox harvesting from Exchange as part of the data collection activity.T1213.002 · SharepointThreat actors discover and collect data from SharePoint.T1550.004 · Web Session CookieCaptured authenticated session tokens are replayed to access victim accounts.T1557 · Adversary-in-the-MiddleThe campaign uses adversary-in-the-middle login flows to capture credentials and MFA approvals.T1566.004 · Spearphishing VoiceThreat actors use phone calls impersonating internal IT or help desk personnel to direct targets to lure URLs.T1567 · Exfiltration Over Web ServiceThe article reports data exfiltration from SharePoint, OneDrive, Exchange, and Box.T1657 · Financial TheftThe campaign issues extortion demands after stealing and exfiltrating victim data.
People
Joshua RiccioNamed by the article as a researcher who co-authored the analysis of the campaign.Stefan HostetlerNamed by the article as a researcher who co-authored the analysis of the campaign.Steven CampbellNamed by the article as a researcher who co-authored the analysis of the campaign.Trevor DaherNamed by the article as a researcher who co-authored the analysis of the campaign.
Threat Actors
CinderData extortion threat actor; the article says Cinder may represent a rebrand or possible continuation of Pink operations.PinkThreat operations that the article says may have continued under Cinder; the identity relationship is presented as possible, not proven.PREY-0058Arctic Wolf's tracking name for the threat cluster conducting the reported data theft and extortion campaign.UNC6671Mandiant's name for a data extortion group whose tradecraft the article says has significant similarities to PREY-0058.
Vendors
Arctic WolfArctic Wolf has linked PREY-0058 to a widespread data theft and extortion campaign that targets Microsoft 365 and other SaaS platforms using help desk vishing, AitM token theft, and residential-proxy sign-ins.Mandiantadding it shares significant tradecraft similarities with a data extortion group that Google-owned Mandiant calls UNC6671.
Products
BoxThe attackers focus on executives, then harvest data from SharePoint, OneDrive, Exchange, and Box before sending extortion demands, with overlaps suggesting ties to UNC6671 and possibly Cinder/Pink.Entra ID“After initial access, the threat actors perform discovery techniques against SharePoint and Entra ID.Microsoft 365 Apps for EnterpriseArctic Wolf has linked PREY-0058 to a widespread data theft and extortion campaign that targets Microsoft 365 and other SaaS platforms using help desk vishing, AitM token theft, and residential-proxy sign-ins.Microsoft Exchange ServerThe attackers focus on executives, then harvest data from SharePoint, OneDrive, Exchange, and Box before sending extortion demands, with overlaps suggesting ties to UNC6671 and possibly Cinder/Pink.Microsoft OneDriveThe attackers focus on executives, then harvest data from SharePoint, OneDrive, Exchange, and Box before sending extortion demands, with overlaps suggesting ties to UNC6671 and possibly Cinder/Pink.Microsoft SharePointThe attackers focus on executives, then harvest data from SharePoint, OneDrive, Exchange, and Box before sending extortion demands, with overlaps suggesting ties to UNC6671 and possibly Cinder/Pink.
Tools
Countries
Industries
ConstructionThe targets are spread across the U.S., primarily in construction and engineering, healthcare and pharmaceuticals, real estate and property management, finance, and professional services.EngineeringThe targets are spread across the U.S., primarily in construction and engineering, healthcare and pharmaceuticals, real estate and property management, finance, and professional services.financeThe targets are spread across the U.S., primarily in construction and engineering, healthcare and pharmaceuticals, real estate and property management, finance, and professional services.HealthcareThe targets are spread across the U.S., primarily in construction and engineering, healthcare and pharmaceuticals, real estate and property management, finance, and professional services.PharmaceuticalsThe targets are spread across the U.S., primarily in construction and engineering, healthcare and pharmaceuticals, real estate and property management, finance, and professional services.Professional ServicesThe targets are spread across the U.S., primarily in construction and engineering, healthcare and pharmaceuticals, real estate and property management, finance, and professional services.Property managementThe targets are spread across the U.S., primarily in construction and engineering, healthcare and pharmaceuticals, real estate and property management, finance, and professional services.real estateThe targets are spread across the U.S., primarily in construction and engineering, healthcare and pharmaceuticals, real estate and property management, finance, and professional services.