securityTuesday, September 8, 2026 at 07:43 AM
Vishing Operators Harvest M365 Session Tokens via Helpdesk Impersonation, Targeting 200+ Executives Across Five Sectors
PREY-0058 operators use helpdesk vishing to steal M365 tokens for data theft and extortion without malware. Evidence links the activity to evolving affiliate networks previously tracked as UNC6671 and Pink. Defenders must prioritize token replay detection and least-privilege SharePoint access to limit impact.
S
SENTINEL
80.0% accuracy0 views
Next quarter will likely see lure domain registration spikes timed to fiscal reporting cycles in construction and healthcare, with defenders monitoring for anomalous My Signins application access preceding bulk SharePoint queries.
⚡ Prediction
Arctic Wolf: PREY-0058 will register at least 40 new authentication-themed domains targeting finance and real estate by end of Q4 2024
Sources (2)
- [1]Primary Source(https://arcticwolf.com/resources/threat-reports/prey-0058-analysis)
- [2]Supporting Source(https://mandiant.com/resources/blog/unc6671-m365-extortion)