PREY-0058 is a widespread social engineering and extortion campaign targeting Microsoft 365 and SaaS platforms. It employs IT helpdesk impersonation via phone and text (vishing) to deceive high-level personnel into divulging credentials through adversary-in-the-middle phishing portals. This enables attackers to bypass multi-factor authentication controls. Following credential compromise, the threat actors perform rapid automated data exfiltration across cloud email, file storage, and other repositories without deploying ransomware payloads. The campaign leverages NodeMaven residential proxy infrastructure to evade detection by blending with legitimate traffic. Extortion demands are delivered via TOX messaging within hours, typically imposing 72-hour deadlines and threatening public data exposure. The campaign's tactics overlap with those of UNC6671 and utilize multiple extortionware brands including BlackFile, Redact, Pink, and Helix.

Successful attacks result in credential theft including bypass of multi-factor authentication, leading to rapid exfiltration of sensitive data from Microsoft 365 and SaaS cloud environments. The campaign does not deploy ransomware but instead uses stolen data for extortion, threatening public exposure. The use of residential proxies complicates detection and attribution. The impact includes potential significant data loss, reputational damage, and financial extortion pressure on targeted organizations.

No official patch or fix applies as this is a social engineering and credential theft campaign rather than a software vulnerability. Organizations should enhance user awareness training focused on vishing and IT impersonation tactics, implement strong verification procedures for helpdesk communications, and monitor for suspicious login activity. Multi-factor authentication should be complemented with additional controls resistant to phishing and adversary-in-the-middle attacks. Review and restrict use of residential proxy traffic where possible. Incident response plans should include rapid containment and communication strategies for extortion attempts. Check vendor advisories and threat intelligence sources for updates on detection and mitigation techniques.