Full Report
Threat hunters have disclosed details of a widespread data theft and extortion threat cluster that's targeting Microsoft 365 and other software-as-a-service (SaaS) offerings through information technology (IT) help desk vishing, adversary-in-the-middle (AitM) token theft, and residential-proxy sign-ins. The activity, which mainly singles out directors, vice presidents, and other executive staff
Analysis Summary
# Incident Report: PREY-0058 Executive Vishing and M365 Data Extortion
## Executive Summary
A sophisticated threat cluster, tracked as PREY-0058 (related to UNC6671/Cinder), is targeting executive-level staff through IT help desk vishing and Adversary-in-the-Middle (AitM) attacks. The attackers bypass MFA using session token theft and residential proxies to exfiltrate bulk data from SaaS environments for extortion. The campaign has successfully compromised numerous organizations across the U.S. by impersonating internal IT support.
## Incident Details
- **Discovery Date:** September 07, 2026 (Public Disclosure)
- **Incident Date:** Ongoing (Reported September 2026)
- **Affected Organization:** Multiple (Hundreds of subdomains impersonating real companies discovered)
- **Sector:** Construction, Engineering, Healthcare, Pharmaceuticals, Real Estate, Finance, and Professional Services.
- **Geography:** United States
## Timeline of Events
### Initial Access
- **Date/Time:** Ongoing
- **Vector:** Voice Phishing (Vishing) / Adversary-in-the-Middle (AitM)
- **Details:** Attackers call executives (VP/Director level) pretending to be internal IT help desk staff. They direct victims to a fake authentication URL (e.g., `passkey-mfa[.]com`) to "register" or "setup" MFA.
### Lateral Movement
- **Details:** Minimal traditional network movement was observed. The attackers move laterally within the SaaS ecosystem (Microsoft 365, Box) by leveraging stolen session tokens to access different cloud applications and SharePoint sites.
### Data Exfiltration/Impact
- **Details:** En masse collection and exfiltration of files from SharePoint, OneDrive, Exchange, and Box. Following exfiltration, the threat actors issue extortion demands to the victims/organizations.
### Detection & Response
- **Discovery:** Identified by Arctic Wolf through monitoring of anomalous residential-proxy token replays and suspicious SharePoint discovery patterns.
- **Response Actions:** Identification of lure infrastructure, tracking of proxy services (NodeMaven), and disclosure of TTPs to the security community.
## Attack Methodology
- **Initial Access:** Vishing (voice phishing) targeting high-level executives.
- **Persistence:** Use of stolen authenticated session tokens; no traditional malware persistence on endpoints.
- **Privilege Escalation:** Not applicable (targets already possess high-level executive access).
- **Defense Evasion:** Use of residential proxies (e.g., NodeMaven) to match the victim's geographic location and ASN during session replay.
- **Credential Access:** AitM phishing pages designed to harvest credentials and MFA approvals.
- **Discovery:** Use of SharePoint SearchQueryPerformed events and wildcard searches (`contentclass:STS_Site`, `contentclass:STS_Web`) to map sensitive data.
- **Lateral Movement:** Session replay across various SaaS applications (My Signins, SharePoint, Box).
- **Collection:** Bulk harvesting of mailboxes and cloud storage files.
- **Exfiltration:** Cloud-to-cloud or cloud-to-attacker infrastructure data transfers.
- **Impact:** Data extortion and potential reputational damage via leak sites.
## Impact Assessment
- **Financial:** Significant potential for extortion payments; costs related to incident response and legal notifications.
- **Data Breach:** High volume of sensitive corporate data, executive communications, and intellectual property.
- **Operational:** Disruption to executive workflows and potential downtime during remediation.
- **Reputational:** High risk due to the public nature of extortion groups like Cinder/Pink.
## Indicators of Compromise
### Network Indicators
- assignpasskey[.]com
- mfaregister[.]com
- nowsso[.]com
- oskeysetup[.]com
- oursso[.]com
- passkey-mfa[.]com
- passkeydeploy[.]com
- registermymfa[.]com
- setpasskey[.]com
- Proxy Infrastructure: NodeMaven
### Behavioral Indicators
- Logins to `My Signins` or `My Profile` from unexpected residential IP ranges.
- SharePoint search queries using `indexdocid` for pagination.
- Rapid, bulk access to SharePoint sites and OneDrive folders not typically accessed by the user.
## Response Actions
- **Containment:** Revocation of all active session tokens for compromised accounts.
- **Eradication:** Blocking of known lure domains at the DNS/Web Gateway level.
- **Recovery:** Resetting of credentials and re-enrollment of MFA devices using phishing-resistant methods.
## Lessons Learned
- **Key Takeaways:** Traditional MFA (SMS/Push) is insufficient against AitM attacks. High-value targets (executives) remain the primary focus for extortion-based groups.
- **Vulnerabilities:** Heavy reliance on employee trust in "IT Support" calls and the lack of phishing-resistant MFA (FIDO2/Passkeys).
## Recommendations
- **Implement Phishing-Resistant MFA:** Transition executives to hardware security keys (FIDO2).
- **Conditional Access:** Enforce policies that restrict access based on device compliance and known-good locations (though residential proxy use complicates this).
- **Staff Education:** Conduct specific vishing awareness training for help desk staff and executives.
- **Least Privilege:** Audit and restrict SharePoint/OneDrive permissions to ensure executives only have access to necessary sensitive data.