Vishing campaign steals M365 tokens via AitM phishing, targets executives

Affected Systems

Microsoft 365, SharePoint, OneDrive, Exchange, and Box SaaS platforms. Primarily targets executive-level staff (directors, VPs) in U.S. organizations across construction, engineering, healthcare, pharmaceuticals, real estate, finance, and professional services sectors.

Exploitation Status

Active widespread campaign. Threat actors (tracked as PREY-0058 by Arctic Wolf, overlaps with Mandiant's UNC6671 and Cinder/Pink groups) are conducting live vishing calls and token theft attacks. Hundreds of lure domains impersonating real companies have been identified.

Business Impact

Attackers gain full access to victim M365 environments through stolen session tokens, bypassing MFA. They exfiltrate data en masse from SharePoint, OneDrive, Exchange, and Box, then send extortion demands. No endpoint malware or lateral movement required—attacks operate entirely in the cloud identity layer. High-value targets (executives) increase risk of business email compromise and sensitive data exposure.

Urgency

🔴 Immediate

Recommended Actions

• Implement Conditional Access policies in Microsoft 365 to restrict sign-ins from residential proxy services (NodeMaven) and anomalous geographic locations/ASNs
• Deploy phishing-resistant MFA (FIDO2/WebAuthn) to prevent token theft via adversary-in-the-middle attacks
• Monitor Microsoft 365 Unified Audit Logs for SearchQueryPerformed events with contentclass:STS_Site, contentclass:STS_Web, and bulk SharePoint/OneDrive access patterns
• Train help desk staff and executives on vishing tactics; establish out-of-band verification procedures for IT support requests involving authentication changes
• Block or alert on newly registered domains matching patterns: assignpasskey[.]com, mfaregister[.]com, nowsso[.]com, oskeysetup[.]com, oursso[.]com, passkey-mfa[.]com, passkeydeploy[.]com, registermymfa[.]com, setpasskey[.]com