Attackers posing as internal IT staff are calling executives and directing them to fake authentication pages, then stealing their Microsoft 365 sessions to raid corporate files and demand payment.

Arctic Wolf tracks the cluster as PREY-0058, noting it shares tradecraft with a group Mandiant calls UNC6671. The operation targets directors, vice presidents and other senior staff through voice phishing, adversary-in-the-middle token theft and sign-ins routed through residential proxies.

Calls lead victims to domains following a pattern of victim organization plus a lure domain, including assignpasskey[.]com, mfaregister[.]com, nowsso[.]com and setpasskey[.]com. The fake login flow captures credentials, multi-factor authentication approvals and session tokens.

Those tokens are replayed from proxy infrastructure such as NodeMaven, using IP addresses matching the victim's location and network. Early sign-in activity touches My Signins, My Profile and My Apps, followed by discovery against SharePoint and Entra ID, then bulk collection and exfiltration from SharePoint, OneDrive, Exchange and Box before extortion demands are sent.

Notably, there is no endpoint malware or network lateral movement. Hundreds of subdomains impersonating real companies have been found. Targets are spread across the U.S., mainly in construction and engineering, healthcare and pharmaceuticals, real estate and property management, finance, and professional services.

Arctic Wolf advises Conditional Access policies, phishing-resistant MFA, tighter SharePoint data scoping, and vishing education for employees and help desk staff. Defenders can disrupt the activity by detecting anomalous residential-proxy token replay, SharePoint discovery and bulk access, mailbox harvesting, and newly registered authentication-themed lure infrastructure.

Source: The Hackers News