PREY-0058 rang executives pretending to be IT, then reportedly emptied SharePoint, OneDrive, Exchange and Box

Arctic Wolf, the security firm that tracks the campaign as PREY-0058, reported in early September 2026 that a vishing operation was hitting senior staff in construction and engineering, healthcare and pharmaceuticals, real estate, finance and professional services. The operation reportedly shares traits with the cluster tracked as UNC6671 and possibly with the Cinder and Pink extortion operations. It begins with a telephone call to a director, vice president or other executive from someone claiming to be internal IT.

The caller directs the executive to a phishing page built specifically for their organisation, using a subdomain that carries the victim's own name on top of a lure domain with a name such as a passkey or MFA registration service. Hundreds of these subdomains have been found. The page is an adversary-in-the-middle proxy: as the executive enters a password and approves the multi-factor prompt, the page relays both to the real Microsoft 365 sign-in and captures the resulting session token.

With the token in hand, the attackers replay it from residential proxy infrastructure, so the sign-in appears to originate from an ordinary home connection. From that session they reportedly mass-export files from SharePoint, OneDrive, Exchange and Box. Nothing is installed on an endpoint and nothing moves sideways through the network. The whole intrusion is a series of legitimate-looking actions by what the platform believes is the executive.

The campaign is one more entry in a widening pattern of help desk impersonation attacks, in which a confident voice and a plausible pretext replace exploits. Executives are chosen because their accounts reach the most valuable data, and because staff are least likely to question a call that appears to come from IT. Extortion demands reportedly follow the theft, so the damage is the exposure of whatever those mailboxes and document libraries held.

The defences that failed here were not weak by conventional standards. Multi-factor authentication was in place and the executive completed it. The sign-in was real, the token was valid, and the export commands were issued through supported Microsoft 365 and Box functions. Every control that asks whether the session is authentic answered yes, because the session was authentic. It simply belonged to the wrong person.

GoFirm places a control at the point where the harm occurs, which is the export. A bulk download from SharePoint, OneDrive, Exchange or Box is an execution event. Before the session can pull that volume of data out of the organisation, a confirmation request goes to the named authority on their registered device, requiring biometric confirmation. The request travels over a separate channel from the one the attacker is holding open, so a stolen password, a relayed MFA code and a hijacked session token are all irrelevant to it.

The executive on the phone may have been talked into a fake passkey page, but the attacker is not holding the executive's registered device and cannot present the executive's biometric. If no confirmation arrives, the export is blocked. A fake help desk call, however convincing, cannot produce that confirmation. The execution boundary holds regardless of how credible the impersonation appears.

GoFirm is The Authority Platform. Stop unauthorised action. Every time.

In association with Osinto.ai, the collective intelligence and governance network for Security, Resilience & Defence teams.

References

1. Lakshmanan, R. 2026. Fake IT calls target executives in Microsoft 365 data theft and extortion attacks. The Hacker News, 7 September 2026.
2. Help Net Security. 2026. IT help-desk vishing tricks executives into handing over Microsoft 365 access. Help Net Security, 8 September 2026.