Security Bulletin: Active Cloud Data Theft and Extortion Campaign Targeting Microsoft 365 and SaaS Platforms

Threat Summary

Arctic Wolf is tracking a widespread IT impersonation and voice-phishing cluster we designate as PREY-0058. Activity associated with PREY-0058 involves multiple extortionware brands, including BlackFile, Redact, Pink, and Helix, and exhibits tradecraft that overlaps with public reporting on UNC6671. Threat actors are bypassing multi-factor authentication (MFA) controls through highly targeted social engineering by either calling or texting victims. If the target falls for the ploy, the attacker gains unauthorized access to Microsoft 365 and associated SaaS platforms without exploiting any software vulnerability. Once inside, they conduct rapid, automated data exfiltration across email, file storage, and cloud document repositories, often completing the full intrusion-to-extortion cycle before security teams detect initial access.

Unlike ransomware operations, these actors do not encrypt or destroy data. Their objective is purely data theft followed by financial extortion, typically delivered within hours of exfiltration via TOX messaging with a 72-hour response window and threats of public data exposure.

The consistent use of static residential proxy infrastructure, especially NodeMaven Proxy (observed in a majority of cases investigated by Arctic Wolf), is intended to blend into legitimate user activity and evade detection.

Arctic Wolf MDR Protection

Arctic Wolf® Managed Detection and Response (MDR) has detections in place that apply to multiple stages of this attack, including suspicious identity activity, cloud reconnaissance, and bulk data access and exfiltration. Arctic Wolf continuously monitors customer environments for behaviors associated with this threat campaign and will alert customers if suspicious activity is detected.

Recommendations

Immediate Priorities

• Recommend vishing awareness training: Because this campaign relies on phone-based social engineering where actors impersonate IT or Help Desk staff, and appears to focus on Directors, Vice Presidents, and more senior users, we recommend the Arctic Wolf Managed Security Awareness® training program for executive and other high-risk groups.
• Notify employees. Inform users that internal IT and Helpdesk will never cold-call or text users to register passkeys or change authentication methods. Users should always verify unexpected support requests through an independent, trusted channel, and organizations should establish a reporting path for suspicious calls.

Identity and Authentication Controls

• Enforce Phishing-Resistant MFA: Transition high-risk and executive accounts to FIDO2 hardware security keys or certificate-based authentication to eliminate Adversary-in-the-Middle (AiTM) phishing risks associated with vishing.
• Restrict Access by Managed/Trusted Devices: Implement Conditional Access policies requiring sign-ins to originate exclusively from compliant, registered, hybrid-joined, or managed enterprise devices.
• Block Residential and Anonymization Proxy Traffic: Enforce Conditional Access or SSO access policies (e.g., via identity providers capable of integrating Spur proxy intelligence) to deny sign-in attempts originating from known residential or callback proxy networks like NodeMaven.

SaaS Data Protection and Governance

• Implement Least-Privilege RBAC for SharePoint: Restrict site, library, and folder permissions using strict Role-Based Access Control (RBAC) to minimize the blast radius of any individual account compromise.
• Deploy Microsoft Purview DLP Thresholds: Configure Data Loss Prevention (DLP) rules within Microsoft Purview to restrict, alert, or block high-volume file downloads within single user sessions.

Example Intrusion Timeline

Stage 1: Vishing, AiTM Access and Identity Changes

1. Actors voice-phish (vish) Directors, Vice Presidents, Executives, and IT staff while impersonating IT/Help Desk teams, then direct them to victim-specific AiTM subdomains using keywords such as passkey, oskey, passkeydeploy, setpasskey, oskeyconnect, or secure-passkey.
2. The AiTM portal captures primary credentials and MFA tokens for Microsoft 365 or Okta/Duo SSO access.
3. In cases observed by Arctic Wolf, actors consistently used static residential NodeMaven Proxy infrastructure, maintaining a fixed residential IP per session to reduce IP-rotation and rate-limiting signals.
4. Initial malicious sign-in activity commonly hits mysignins.microsoft.com and myaccount.microsoft.com to covertly learn more about the compromised user account; in a subset of cases, the threat actor initiates password resets and MFA registrations (User started security info registration, User registered security info are generated for these operations).

Stage 2: Exchange Mailbox Harvesting

1. Actors pivot to Exchange Online using the One Outlook Web Client App (AppID info 9199bf20-a13f-4107-85dc-02114787ef48). Use of this application is normal. However, this threat actor’s toolkit uses this AppID to retrieve mail from an abnormal API path (API ID c999ed3e-27ae-4cb3-b3a2-46b056af63d3). This is not typical behavior for this One Outlook Web client application.
2. This activity typically generates a high volume of MailItemsAccessed and AttachmentAccessed events, with exfiltration sources ranging from datacenter/hosting infrastructure to the same residential proxy networks used for initial access.

Stage 3: SharePoint and Cloud Storage Enumeration

1. Actors access SharePoint Online and execute broad queries via API to map accessible sites (contentclass:STS_Site) and subsites (ccontentclass:STS_Web). This activity generates SearchQueryPerformed event logs.
2. Similarly, the threat actors execute a wildcard query (*) to list all documents available in SharePoint and then paginate (contentindexdocid>*) through the results.

Stage 4: Bulk Exfiltration and TOX Extortion

1. Bulk file retrieval (FileAccessed / FileDownloaded) begins immediately after the discovery queries are executed.
2. User agents have evolved from Python tooling (python-requests, python-requests) in the original compromise cases, to spoofed Chrome strings (Chrome/146, Chrome/150, Chrome/151.0.0) in the more recent compromise cases, likely adapted to evade detection.
3. Extortion emails are sent to victim executives with TOX contact details, a 72-hour response window, public leak threats, and proof-of-possession sample offers.

Indicators of Compromise (IOCs)

This is a list of IOCs Arctic Wolf recommends for defensive actions. Note that this list is not an exhaustive list of observations and is not intended for threat hunting or true positive incident confirmation. Do not use these indicators or techniques for offensive purposes.

References:

• Google Cloud Threat Intelligence: UNC6671 Targets Financial Services and Enterprise Cloud Environments
• ReliaQuest Threat Spotlight: Helix – New Name in Data Extortion Ecosystem
• Okta Threat Intelligence: Behind the Scenes of a Vishing Operation
• Microsoft Technical Documentation: Pagination for Large Result Sets in SharePoint