PREY-0058 Uses Help-Desk Calls and Residential Proxies to Defeat Microsoft 365 MFA

A threat cluster tracked as PREY-0058 is compromising corporate cloud accounts by impersonating internal IT personnel over the telephone. Rather than deploying malware or exploiting a software vulnerability, the attackers persuade employees to authenticate through phishing portals designed for real-time interception.

According to a report published by Artic Wolf on September 08, 2026, the campaign frequently targets directors, vice presidents, and other executives. Once inside, the operators search Microsoft 365 and connected software-as-a-service platforms, collect corporate data, and may issue extortion demands.

The campaign combines voice phishing, adversary-in-the-middle infrastructure, stolen session tokens, and residential proxies selected to resemble the victim’s normal location. That combination can weaken detections based primarily on geography or impossible travel.

A phone call starts the compromise

PREY-0058 operators pose as an organization’s IT department or help desk. The victim is then directed to an authentication-themed phishing page, often hosted at an address following this pattern:

<victim organization>.<lure domain>

Including the target’s name in the hostname makes the page appear related to the employer, especially when viewed quickly during a telephone conversation. The call also creates urgency and gives the attacker an opportunity to guide the victim through each authentication step.

The rogue portal supports an adversary-in-the-middle, or AiTM, attack. Instead of merely collecting a static password, the phishing infrastructure relays authentication activity between the victim and the legitimate Microsoft service.

This allows the operators to intercept credentials and MFA approvals as they are submitted. More critically, they can obtain the authenticated Microsoft 365 session token created after the user completes the login process.

The stolen token is then replayed to access the account. Because the session has already passed authentication, the attacker may not need to prompt for MFA again until the token expires, is revoked, or encounters another access-control decision.

No endpoint exploit is required. Conventional antivirus and endpoint detection tools may therefore see little or nothing during the initial compromise.

Residential proxies make malicious sessions look local

PREY-0058 uses residential proxy infrastructure, particularly NodeMaven, to relay access to compromised accounts. The operators select proxy addresses that correspond to the victim’s geographic area and, in some cases, the same network or autonomous system number.

This technique is intended to make the stolen session resemble legitimate activity. A user who normally signs in from one city might appear to remain in that city even though an attacker is controlling the session elsewhere.

It also limits the usefulness of impossible-travel alerts. Those controls are effective when an account appears in distant locations within an unrealistic period, but they are less reliable when both sessions originate from nearby addresses.

Location should therefore be treated as one signal, not proof of legitimacy. Defenders should compare the apparent geography with other characteristics, including:

• Internet service provider and ASN
• Residential proxy or hosting-provider attribution
• Browser and operating-system profile
• User-agent strings
• Device-management and compliance status
• Applications opened at the beginning of the session
• File, email, and directory activity after authentication

A session that appears geographically normal may still be hostile if its network provider, device state, or behavior differs from the account’s established pattern.

Attackers map applications before collecting data

After replaying a stolen token, the operators commonly access Microsoft account interfaces such as OfficeHome, My Signins, My Profile, My Apps, and Microsoft Account Controls.

These services expose useful information about the victim’s account and the applications available through it. Early access to several of these interfaces can indicate that an intruder is determining what the account can reach before beginning broader reconnaissance.

PREY-0058 then investigates Microsoft Entra ID and SharePoint. SharePoint discovery can produce SearchQueryPerformed audit events containing search expressions such as:

contentclass:STS_Site
contentclass:STS_Web

The attackers may also use wildcard searches with indexdocid to paginate through results. This activity supports systematic enumeration of SharePoint sites, web resources, document repositories, and potentially valuable files.

Data collection can subsequently expand across:

• SharePoint
• OneDrive
• Exchange
• Box

The operators may automate access using Python’s requests library or the Microsoft Graph API, allowing them to retrieve files faster than an attacker working manually through a browser. Large-scale collection can expose corporate documents, email, and data stored in connected SaaS platforms.

Extortion may follow the theft. The primary risk is therefore not control of an employee’s computer, but unauthorized use of a trusted cloud identity to reach information that the employee is already permitted to access.

Detection requires cloud and identity telemetry

Defenders should first examine sign-ins associated with NodeMaven, other residential proxy services, and hosting providers. However, blocking one named network will not address operators that rotate infrastructure.

The sequence of activity is often more revealing than any single IP address. An unusual session may begin with account-management interfaces, progress to SharePoint or Entra ID discovery, and end with extensive file or mailbox access.

High-priority detection patterns include:

1. Unexpected access to OfficeHome, My Signins, My Profile, My Apps, or Microsoft Account Controls immediately after login.
2. Differences from the user’s normal ISP, ASN, browser, operating system, device, or user agent.
3. SearchQueryPerformed events that enumerate SharePoint sites, webs, or files.
4. Bursts of Exchange MailItemsAccessed events over a short period.
5. Large volumes of SharePoint or OneDrive file views and downloads from one account.
6. File retrieval through Python-based HTTP requests or Microsoft Graph.
7. Cloud activity from residential proxy and hosting addresses, even when the location appears normal.
8. Newly registered or newly observed domains imitating the organization and requesting MFA, passkey, or authentication enrollment.

Security teams should correlate these signals rather than evaluating them separately. For example, a local residential IP might not appear dangerous by itself, but it becomes significant when paired with an unmanaged device, a new user agent, SharePoint enumeration, and a sudden download spike.

Artic Wolf also released indicators of compromise associated with PREY-0058. The specific domain and IP values are not included in the available campaign details, so defenders should also maintain behavioral detections that remain effective as infrastructure changes.

Managed devices and resistant credentials reduce exposure

Organizations should require Microsoft 365 access from managed, compliant devices wherever operationally possible. A stolen token used from an unknown device should face additional access controls rather than being accepted solely because the password and MFA process were previously completed.

Connections from residential proxies and hosting providers can be blocked, restricted, or subjected to stronger verification. Exceptions may be necessary for legitimate users, but those exceptions should not eliminate device and behavioral checks.

Microsoft Continuous Access Evaluation can help reassess active sessions when relevant security conditions change. Administrators should also be prepared to revoke sessions quickly when token theft is suspected.

For authentication, organizations should prioritize phishing-resistant methods such as FIDO2 security keys and device-bound passkeys. These controls offer stronger protection against AiTM phishing than approval prompts or credentials that users can relay through a deceptive website.

Additional measures include limiting access to sensitive SharePoint repositories, reviewing whether executives have broader permissions than required, and monitoring bulk access across Microsoft 365 and Box.

Employees and help-desk personnel also need a fixed procedure for unexpected support calls. A user should terminate the call and independently contact IT through an established internal number or authenticated support channel. Contact details supplied by the caller should not be trusted.

This is an identity attack, not a patchable flaw

No CVE, vulnerable software version, or vendor patch is associated with the reported campaign. Microsoft 365, Entra ID, SharePoint, OneDrive, Exchange, and Box are involved as targeted services, but no specific affected versions have been disclosed.

The CISA Known Exploited Vulnerabilities catalog is consequently not applicable: PREY-0058 is exploiting people, authentication workflows, and stolen sessions rather than a documented software vulnerability.

That distinction changes the defensive response. Patching endpoints alone will not stop the campaign. Organizations must harden cloud access policies, deploy phishing-resistant authentication, reduce excessive data permissions, and investigate identity sessions even when their apparent location looks familiar.