M365 Token Theft Campaign Exploits Help Desk Vishing to Bypass MFA and Extort Enterprises

Security researchers at Arctic Wolf disclosed an active data theft and extortion cluster dubbed PREY-0058, which specifically targets corporate executives across Microsoft 365 and connected SaaS platforms. The threat actor begins attacks with voice phishing (vishing) calls, posing as internal IT help desk personnel to steer directors and vice presidents toward attacker-controlled Adversary-in-the-Middle (AitM) infrastructure. Once the victim enters credentials and approves multi-factor authentication (MFA) requests, the operators harvest the authenticated session tokens. To bypass risk-based sign-in policies, the attackers immediately replay these tokens through residential proxy services (such as NodeMaven) configured to match the victim's exact ASN and geographic location. Once authenticated, they conduct automated reconnaissance across SharePoint and Entra ID before exfiltrating bulk data from OneDrive, Exchange, and Box to fuel extortion demands. This campaign underscores a critical architectural vulnerability in enterprise identity pipelines: the distinction between initial authentication and persistent session validity. When threat actors steal fully authenticated session tokens and route them through residential proxies, traditional security controls—including push-based MFA, simple conditional access rules, and geographic impossible-travel detections—fail entirely. High-privilege executive accounts often retain broad read access across enterprise repositories; once a session is hijacked, adversaries can systematically weaponize SharePoint search APIs (such as querying STS_Site and STS_Web classes) to extract terabytes of sensitive intellectual property and corporate communications without triggering standard malware alerts. PREY-0058 reflects a broader structural evolution in cybercrime tradecraft, sharing operational overlap with extortion clusters like UNC6671 and Pink operations. As endpoint security and perimeter defenses have hardened, adversaries have systematically pivoted to identity supply chains and SaaS-native data stores. Rather than deploying disruptive ransomware on endpoints, attackers prioritize silent data theft through valid credentials and cloud APIs, drastically compressing dwell time while maximizing leverage. The industrialization of AitM proxy platforms and residential proxy networks has made real-time session interception accessible to mid-tier criminal syndicates, rendering legacy MFA schemes obsolete across cloud environments. Defenders must harden both social and technical identity layers. Organizations should mandate phishing-resistant authentication—specifically FIDO2 hardware keys or passkeys—for all executive and administrative staff, which natively prevents AitM interception. Concurrently, identity teams should enforce Entra ID Continuous Access Evaluation (CAE) and token binding to invalidate stolen cookies if network contexts drift. Security operations centers (SOCs) need to develop specific detection heuristics for anomalous SharePoint bulk discovery queries and session token replay originating from residential ISP IP blocks. Finally, IT help desks must institute rigid out-of-band verification workflows, ensuring no credential reset or authentication approval ever occurs during unsolicited inbound communications.