PREY-0058 vishing: nothing for your EDR to catch

Arctic Wolf Labs disclosed a data theft and extortion cluster on September 7 that it tracks as PREY-0058. The operators call executives pretending to be the internal help desk, walk them into an adversary-in-the-middle login page, steal the session token, and then read the company's SharePoint from a residential IP. There is no malware anywhere in the PREY-0058 vishing chain — which is the part that should change how you think about the money you spend on endpoint tooling.

What actually happened

Per Arctic Wolf Labs' analysis, reported by The Hacker News, the targeting is deliberate: directors, VPs, and executive staff at U.S. organizations in construction and engineering, healthcare and pharmaceuticals, real estate and property management, finance, and professional services. Arctic Wolf notes significant tradecraft overlap with UNC6671, a data extortion group Mandiant tracks separately.

The chain runs like this. A phone call impersonating internal IT. A URL shaped as <victim>.<lure-domain> so it reads like a company-specific portal — Arctic Wolf found hundreds of entries impersonating real companies across the lure infrastructure. The victim authenticates and approves MFA against an operator-controlled Microsoft 365 login that relays to the real one. The operator captures the resulting token and replays the session through residential proxy infrastructure, so the sign-in looks like a normal user on a normal home connection instead of a datacenter IP your conditional access policy might flag.

Then: Entra ID and SharePoint discovery, bulk exfiltration from SharePoint, OneDrive, Exchange, and Box, and an extortion demand.

What is absent is the story. No endpoint malware. No network lateral movement. Nothing to detect, quarantine, or roll back.

Why it matters for your business

Every security product you have been sold assumes something lands on a machine. PREY-0058 never puts anything on a machine. The attacker holds a valid token for a real account and uses the same APIs your staff use. From the log's perspective, a VP opened SharePoint.

The MFA point is the one operators keep getting wrong. Push-approval MFA does not stop this — the victim approves the prompt, and the relay forwards it. What stops it is phishing-resistant MFA: passkeys or FIDO2 hardware keys, which are cryptographically bound to the real domain and simply will not sign for a lookalike. That is a real project, and it is the only control on this list that breaks the chain instead of narrowing it.

Alongside it, three things that cost less:

Give your help desk a verification script and the authority to use it. The attack is a phone call. If your process for "IT needs you to re-authenticate" is a return call to a number from the directory, the chain dies at step one. Tell your executives that too — they are the ones being called.

Cut what a single account can reach. Bulk SharePoint exfiltration only works if one login can see everything. Most small companies have exactly one library and everyone in it.

Alert on impossible sessions, not impossible travel. Residential proxies defeat geography. A token issued in one session and used from a different IP and user agent is the signal.

We have written this post before with Brinks Home and RingCentral on the label. The vector is not getting more sophisticated. It is getting more industrialized.

Sources: The Hacker News reporting Arctic Wolf Labs research, Arctic Wolf Labs blog.