Forget installing malware because today’s extortionists just pick up the phone instead of writing code. A widespread threat cluster tracked as PREY-0058 bypasses endpoint security entirely by targeting Microsoft 365 and SaaS environments through pure social engineering.
Attackers pose as internal IT help desk staff via phone calls and direct executives toward rogue authentication portals.
“The threat actors impersonate internal IT or helpdesk personnel by phone and direct them to an authentication-themed URL, often formatted as .
.” reads the report published by Artic Wolf. “These attacks most frequently target Directors, Vice Presidents, and other executive staff.”
Once victims land on these pages, adversary-in-the-middle panels intercept credentials and multi-factor approvals in real time.
Stolen session tokens are then replayed using residential proxy networks that match the victim’s exact geographic location.
“Stolen sessions are replayed from residential proxy infrastructure, most notably NodeMaven, often from IP addresses that resolve to the same geo-location and network (ASN) as the victim.” states Artic Wolf. “Initial sign-in activity involves applications such as “My Signins”, “My Profile”, “My Apps”, which reveal account details and the applications available to the victim.”
This clever trick blinds standard impossible travel alerts and leaves defenders scratching their heads.
Intruders waste no time once they slip past the front door, immediately shifting focus to massive data harvesting.
“After initial access, the threat actors perform discovery techniques against SharePoint and Entra ID.” continues the report. “SharePoint discovery includes SearchQueryPerformed
events with contentclass:STS_Site
, contentclass:STS_Web
, and wildcard searches using indexdocid
for pagination.”
They map out repositories and drain sensitive files from OneDrive, Exchange, and Box before dropping a heavy extortion demand.
To detect these attacks, monitor Microsoft 365 sign-ins coming from residential proxies or hosting networks such as NodeMaven. Suspicious activity is more likely when several common Microsoft account pages are accessed at the start of a session, especially OfficeHome, My Signins, My Profile, My Apps and Microsoft Account Controls.
Alerts should also consider changes from a user’s normal sign-in pattern, such as a different location, ISP, browser, operating system or user agent.
In SharePoint, look for unusual SearchQueryPerformed events that map or enumerate sites and files. In Exchange, watch for large numbers of MailItemsAccessed events in a short time, especially when they come from hosting or proxy IPs. Also monitor heavy SharePoint and OneDrive file access or downloads from one user, particularly when scripting tools such as Python requests or Microsoft Graph are used. Finally, watch for new phishing domains that imitate your organization and target passkey or MFA registration.
To reduce the risk, require managed devices for Microsoft 365 and block or challenge access from proxy and hosting networks. Use phishing-resistant MFA such as FIDO2 keys or device-bound passkeys, which can stop AiTM attacks. Limit users’ access to sensitive SharePoint data, enable Continuous Access Evaluation, and train employees and help-desk teams to verify unexpected IT calls through a trusted channel.
Artic Wolf also released Indicators of Compromise (IoCs) for these attacks.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, IT Help Desk)