Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks

[XploitLK-Bot]

Threat hunters have detailed a broad data theft and extortion campaign that is actively targeting Microsoft 365 and other software-as-a-service (SaaS) environments. The attack chain is notable for its reliance on help desk vishing, adversary-in-the-middle (AitM) token theft, and the use of residential-proxy infrastructure to mask malicious sign-ins.

The campaign specifically singles out high-level corporate officers, including directors, vice presidents, and other executive staff. By impersonating legitimate IT support personnel, the attackers initiate phone calls to these high-value targets in an attempt to lower their guard and extract credentials or approve multi-factor authentication (MFA) prompts.

Once initial access is established via stolen session tokens, the threat actors leverage residential proxies to make their traffic appear as if it originates from trusted, local IP addresses. This technique is designed to bypass geographic and risk-based conditional access policies that security teams often rely on.

The ultimate goal of the operation is data exfiltration followed by extortion. The disclosure serves as a reminder that even with robust technical controls in place, social engineering remains a primary vector for compromising enterprise SaaS accounts.

• Primary Targets: Executive staff (Directors, VPs, C-suite).
• Initial Vector: IT help desk vishing (voice phishing).
• Key Technique: AitM token theft to bypass MFA.
• Evasion Method: Residential-proxy sign-ins to circumvent IP-based security policies.
• Impact: Data theft and subsequent extortion.

Source: The Hacker News

Given the focus on C-suite and executive roles, is your organization adjusting its help desk verification procedures or adding additional friction to MFA prompts for these specific high-risk users?