Arctic Wolf tracks vishing campaign targeting Microsoft 365 executives

Arctic Wolf has detailed a campaign it tracks as PREY-0058, in which attackers use IT help-desk vishing calls to trick executives into handing over Microsoft 365 access. The activity shares tradecraft with a group Google calls UNC6671, and the extortion side has operated under names including BlackFile, Pink, Helix, Cinder and Redact.

The attackers call targets posing as internal IT, then send a link to a fake authentication page that captures passwords and MFA approvals through an adversary-in-the-middle panel. Once inside, they map out SharePoint and other SaaS apps before bulk exfiltrating data from SharePoint, OneDrive, Exchange and Box, often through residential proxies.

Arctic Wolf advises organisations to tighten Conditional Access, use phishing-resistant MFA, limit SharePoint account reach, and train help-desk staff to spot vishing. It also published indicators of compromise for defenders to check their logs.