Vishing Campaign Targets M365 Executive Accounts

Executive Summary

A sophisticated and widespread data extortion campaign is targeting high-level corporate employees, including directors and vice presidents. The threat cluster, tracked by Arctic Wolf as PREY-0058, employs a multi-faceted approach that combines voice phishing (vishing), adversary-in-the-middle (AitM) phishing infrastructure, and residential proxies to compromise Microsoft 365 accounts. The attackers impersonate the victim's IT help desk over the phone, tricking them into authenticating on a malicious site. This allows the threat actors to steal the user's session token, bypass MFA, and gain access to sensitive data stored in SharePoint, OneDrive, and other cloud services. The exfiltrated data is then used in extortion demands. The campaign's TTPs show a significant overlap with a group Mandiant tracks as UNC6671.

Threat Overview

The PREY-0058 attack chain is methodical and designed to bypass modern security controls like MFA.

1. Initial Contact (Vishing): The attack begins with a phone call to a targeted executive. The attacker spoofs the company's IT help desk phone number and uses social engineering to create a sense of urgency, such as a required security update or account migration.

2. Phishing Lure: During the call, the victim is directed to a malicious website. These domains are crafted to look legitimate, often using patterns like <victim organization>.<lure domain> (e.g., acme-corp.mfaregister.com).

3. Session Token Theft: The malicious site is an Adversary-in-the-Middle (AitM) phishing platform. When the user enters their credentials and completes the MFA prompt (e.g., by tapping 'Approve' on their phone), the AitM framework intercepts the entire authentication flow and captures the resulting session cookie.

4. Session Replay and Data Exfiltration: The attackers immediately use the stolen session cookie to log into the victim's Microsoft 365 account. To evade detection, these logins are routed through residential proxy services like NodeMaven, with IP addresses often geolocated to the victim's region. Once inside, the attackers access and exfiltrate large volumes of data from SharePoint, OneDrive, Exchange Online, and Box.

5. Extortion: After securing the data, the threat actors contact the victim organization, threatening to leak the stolen information unless a ransom is paid.

Technical Analysis

This campaign is notable for its focus on identity and data, rather than endpoint compromise. The attackers do not deploy malware or attempt traditional lateral movement within the corporate network. Their entire operation is cloud-native, abusing legitimate authentication protocols and cloud services.

The use of residential proxies is a key defense evasion technique. It makes the malicious logins appear to originate from legitimate residential ISPs in the same geographic area as the victim, making IP-based blocking and geofencing policies ineffective.

The overlap with UNC6671 suggests a well-organized and persistent threat actor. This group's tradecraft is specifically designed to circumvent MFA, which many organizations rely on as their primary defense against account takeover.

MITRE ATT&CK Techniques

• T1566.004 - Spearphishing Voice: The initial vishing call to the target.
• T1598.003 - Spearphishing Link: Directing the user to the malicious AitM site.
• T1649 - Steal or Forge Authentication Tokens: The core of the attack, capturing the session cookie via the AitM site.
• T1114.002 - Remote Email Collection: Accessing and exfiltrating data from Exchange Online.
• T1530 - Data from Cloud Storage Object: Exfiltrating files from SharePoint and OneDrive.
• T1071.004 - DNS: Using residential proxies for C2 and access, which involves DNS lookups.

Impact Assessment

The campaign targets high-value individuals with access to the most sensitive corporate data. A successful attack can lead to:

• Breach of confidential business strategies, financial records, and intellectual property.
• Significant extortion costs.
• Reputational damage and loss of customer trust if data is leaked.
• Regulatory fines for data breaches, especially if PII or PHI is involved.

Because the attack bypasses MFA, it undermines confidence in a foundational security control and demonstrates that technical solutions must be paired with continuous user education.

Detection & Response

• Monitor for Impossible Travel: While attackers use geolocated proxies, alerts for logins from new devices, ASNs, or ISPs, even within the same region, can be valuable. Correlate this with other suspicious activity.
• Analyze Session Activity: Look for Microsoft 365 sessions with anomalous characteristics, such as an unusually high volume of file downloads or access to multiple SharePoint sites in a short period. Microsoft Purview and Defender for Cloud Apps can help detect this.
• User-Reported Phishing: A robust system for employees to report suspicious calls and emails is a critical early warning signal.
• Hunt for Lure Domains: Proactively search DNS and proxy logs for domains matching the patterns used by PREY-0058, such as those containing mfaregister or setpasskey.

Mitigation

1. Phishing-Resistant MFA: The most effective technical control is to move towards phishing-resistant MFA, such as FIDO2 security keys or certificate-based authentication. These methods bind the authentication to the hardware and are not susceptible to AitM credential interception.
2. User Education: Conduct ongoing security awareness training focused on vishing. Teach employees, especially executives, to be suspicious of unsolicited calls from 'IT' and to establish a secondary verification channel (e.g., calling the help desk back on a known-good number) before taking any action.
3. Conditional Access Policies: Implement strict Microsoft 365 Conditional Access policies. For example, require logins to come from compliant or hybrid-joined devices. This would block attackers using stolen session tokens on their own machines.
4. Limit Session Lifetimes: Configure shorter session lifetimes and idle timeouts in Microsoft 365 to reduce the window of opportunity for an attacker to use a stolen token.