Fake IT Calls Let Threat Actors Drain Executive Microsoft 365 Accounts

A threat group tracked as PREY-0058 is executing a massive vishing campaign against corporate directors and vice presidents. The attackers mimic internal IT support to push executives toward adversary-in-the-middle login pages that capture Microsoft 365 session tokens. Researchers from Arctic Wolf discovered hundreds of lure subdomains built to impersonate real companies across US healthcare, construction, and finance. The threat group avoids deploying traditional endpoint malware, relying exclusively on token replay via NodeMaven residential proxies to drain SharePoint and Exchange data. "Defenders can disrupt this activity by detecting anomalous residential-proxy token replay, SharePoint discovery and bulk access, mailbox harvesting, and newly registered authentication-themed lure infrastructure." — Arctic Wolf