Loading story…
The PREY-0058 threat cluster is targeting executives with voice-phishing calls impersonating internal IT help-desk staff. Operators direct victims to fraudulent Microsoft 365 authentication pages using adversary-in-the-middle phishing, capturing credentials, MFA approvals, and authenticated session tokens. They replay those tokens through residential proxies—frequently NodeMaven addresses selected to match the victim’s apparent geography and network profile—to bypass normal MFA protections.
After gaining access, the attackers enumerate Microsoft Entra ID and SharePoint and bulk-exfiltrate information from SharePoint, OneDrive, Exchange, and Box before issuing extortion demands. The activity overlaps with tradecraft attributed to UNC6671 and potentially Cinder or Pink-linked operations. Organizations should verify unexpected IT calls through trusted channels, require managed devices and phishing-resistant MFA such as FIDO2 keys or device-bound passkeys, restrict proxy-originated access, enable Continuous Access Evaluation, and monitor for token replay and anomalous bulk SaaS-data collection.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Arctic Wolf assessed that the PREY-0058 SaaS data-theft and extortion cluster has significant tradecraft similarities with the group Google Threat Intelligence Group tracks as UNC6671.
Arctic Wolf assessed with moderate confidence that the Cinder extortion brand is a rebrand or possible continuation of Pink operations, citing overlap between organizations listed on Cinder's leak site and victims linked to Pink-attributed phishing infrastructure. The report also associated PREY-0058 activity with BlackFile, Pink, Helix, Cinder, and Redact while cautioning that the labels do not prove a single actor identity.
Arctic Wolf reported that the PREY-0058 threat cluster impersonates IT help-desk staff in vishing calls, uses adversary-in-the-middle Microsoft 365 phishing to steal session tokens, and replays them through residential proxies. The cluster targets executives, collects data from Microsoft 365 services and Box, and issues extortion demands; Arctic Wolf also released indicators of compromise.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
6 references tracked. Mallory keeps watching after this page renders.
rhisac.org
Open sourcehelpnetsecurity.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcearcticwolf.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A newly tracked extortion group known as **Pink** is using voice phishing and fake internal help-desk calls to trick employees into entering credentials and MFA codes on attacker-controlled phishing pages. Researchers tracking the activity as `CL-CRI-1147` said the actor appears likely **Com-affiliated** and follows a social-engineering playbook associated with groups such as Lapsus$, Scattered Spider, and ShinyHunters. After account takeover, Pink rapidly accesses Microsoft cloud services including **SharePoint** and **OneDrive**, steals sensitive data, and then uses the compromised accounts to send extortion emails and internal **Microsoft Teams** messages to pressure victims. Investigators said the group has also stood up a leak site and typically gives organizations **72 hours** to respond to extortion demands. The campaign shows repeated infrastructure reuse across victims, with common second-level domains and victim-specific subdomains, and phishing hosting frequently tied to **DDoS-Guard**. Reported indicators include the domains `passkeyadd.com`, `passkeydeploy.com`, and `deploypasskey.com`, along with the IP addresses `185.178.208.153`, `172.93.100.252`, and `96.232.20.66`, giving defenders concrete artifacts for threat hunting and blocking.
Jun 29, 2026
A threat actor tracked by Okta as **O-UNC-066** and linked to the **Pink** extortion operation is targeting enterprise Microsoft 365 users with voice phishing calls that impersonate internal security staff and direct victims to enroll a new Microsoft Entra passkey. The campaign, active since April, uses domains containing the word "passkey" and phishing pages designed to closely mimic Microsoft’s legitimate Entra passkey enrollment flow, taking advantage of Microsoft’s newer passkey registration prompts and campaign features introduced for administrators. Okta said the operation relies on an operator-controlled PHP phishing panel that relays credentials and MFA responses in real time and adapts to the victim’s authentication method, allowing the attacker to authenticate to the victim’s Microsoft account and register a passkey under the attacker’s control. Researchers said the compromises are followed by rapid data theft from **SharePoint** and **OneDrive**, with victims observed across the food and beverage, technology, healthcare, automotive, construction, and aviation sectors; Pink has also launched an extortion site to pressure organizations by publishing samples of stolen data.
Jul 17, 2026
Researchers and incident responders are warning that attackers are increasingly abusing Microsoft Entra ID's OAuth 2.0 **device code flow** to hijack Microsoft 365 accounts through legitimate sign-in prompts rather than malware or software exploits. In these attacks, victims are tricked via **vishing** or phishing into entering an attacker-supplied code at Microsoft's device login page and approving MFA, which issues the attacker valid access and refresh tokens. Security firms say the technique can provide broad access to services including **Microsoft Graph**, **Exchange Online**, **OneDrive**, and **SharePoint**, and that password resets alone may not fully contain the intrusion because refresh tokens can persist across services. The activity has been tied to data theft and follow-on abuse. ReliaQuest reported that the **Helix** extortion group used device code phishing, MFA abuse, and rogue authenticator registration to access victim Microsoft 365 tenants, enumerate SharePoint, and exfiltrate data before extortion; reported victims include Medtronic, Nissan, NAIC, Kodak, Infinite Campus, and the University of Nottingham. Separate investigations documented attackers signing in from foreign locations, registering multiple devices, creating hidden inbox rules to suppress replies, and using compromised mailboxes to send phishing messages at scale. Microsoft and security researchers recommend blocking or restricting device code authentication with **Conditional Access**, limiting SharePoint and device registration to managed devices, and monitoring Entra ID telemetry for `AuthenticationProtocol` set to device code, unusual travel, mailbox rule changes, and spikes in device registrations.
Jul 23, 2026