Active Cloud Data Theft and Extortion Campaign Targeting Microsoft 365 and SaaS Platforms
Source AlienVault OTX General
Description
A widespread IT impersonation and voice-phishing campaign designated PREY-0058 is actively targeting Microsoft 365 and SaaS platforms. Threat actors impersonate IT helpdesk staff via phone or text to trick executives and senior personnel into divulging credentials through adversary-in-the-middle phishing portals. After bypassing multi-factor authentication, attackers conduct rapid automated data exfiltration across email, file storage, and cloud repositories without deploying ransomware. The operation relies heavily on NodeMaven residential proxy infrastructure to blend with legitimate traffic. Extortion demands are delivered via TOX messaging within hours of compromise, typically with 72-hour deadlines and threats of public data exposure. The campaign exhibits tradecraft overlapping with UNC6671 and involves multiple extortionware brands including BlackFile, Redact, Pink, and Helix.
Impact
Successful attacks result in credential theft including bypass of multi-factor authentication, leading to rapid exfiltration of sensitive data from Microsoft 365 and SaaS cloud environments. The campaign does not deploy ransomware but instead uses stolen data for extortion, threatening public exposure. The use of residential proxies complicates detection and attribution. The impact includes potential significant data loss, reputational damage, and financial extortion pressure on targeted organizations.
Defensive guidance
No official patch or fix applies as this is a social engineering and credential theft campaign rather than a software vulnerability. Organizations should enhance user awareness training focused on vishing and IT impersonation tactics, implement strong verification procedures for helpdesk communications, and monitor for suspicious login activity. Multi-factor authentication should be complemented with additional controls resistant to phishing and adversary-in-the-middle attacks. Review and restrict use of residential proxy traffic where possible. Incident response plans should include rapid containment and communication strategies for extortion attempts. Check vendor advisories and threat intelligence sources for updates on detection and mitigation techniques.
Indicators of compromise
Domains 9
- setpasskey.com
- assignpasskey.com
- oskeysetup.com
- oskeyconnect.com
- secure-passkey.com
- mfaregister.com
- passkey-mfa.com
- registermymfa.com
- oskey.com