PREY-0058 Uses Fake IT Help-Desk Calls to Steal Microsoft 365 Data

The PREY-0058 threat cluster is targeting executives with voice-phishing calls impersonating internal IT help-desk staff. Operators direct victims to fraudulent Microsoft 365 authentication pages using adversary-in-the-middle phishing, capturing credentials, MFA approvals, and authenticated session tokens. They replay those tokens through residential proxies—frequently NodeMaven addresses selected to match the victim’s apparent geography and network profile—to bypass normal MFA protections.

After gaining access, the attackers enumerate Microsoft Entra ID and SharePoint and bulk-exfiltrate information from SharePoint, OneDrive, Exchange, and Box before issuing extortion demands. The activity overlaps with tradecraft attributed to UNC6671 and potentially Cinder or Pink-linked operations. Organizations should verify unexpected IT calls through trusted channels, require managed devices and phishing-resistant MFA such as FIDO2 keys or device-bound passkeys, restrict proxy-originated access, enable Continuous Access Evaluation, and monitor for token replay and anomalous bulk SaaS-data collection.