FAKE IT CALLS TARGET EXECUTIVES IN MICROSOFT 365 DATA THEFT AND EXTORTION ATTACKS

Summary from the TLDR InfoSec newsletter

PREY-0058 targets executives through fake IT help-desk calls and authentication-themed domains. Its AitM pages capture Microsoft 365 credentials, MFA approvals, and session tokens. Operators replay tokens through residential proxies, then enumerate SharePoint and Entra ID. They bulk-exfiltrate SharePoint, OneDrive, Exchange, and Box data before issuing extortion demands. Defenders are advised to watch for proxy token replay, mailbox harvesting, and new MFA-themed domains.