Microsoft 365 phishing targets executives via fake IT calls

Arctic Wolf tracks PREY-0058, a Microsoft 365 phishing cluster impersonating IT staff via vishing and AitM token theft to bypass MFA. Attacks target executives, exfiltrate SharePoint, OneDrive, Exchange, and Box data, then demand extortion. CloudSEK tracked over 5,000 stolen records.