The help desk call that hands over your Microsoft 365

What happened

In September 2026, the security firm Arctic Wolf described a campaign it tracks as PREY-0058. Google's threat intelligence group tracks a related extortion crew as UNC6671. The attack starts with a phone call.

Here is how it runs:

1. An attacker calls an employee posing as internal IT and offers to help with a routine passkey or MFA setup.
2. The employee gets a link to a convincing sign-in page, often on a lookalike subdomain using the company's name.
3. That page relays the real login to the attacker, capturing the password, the MFA approval and a live session token.
4. Using the session, the attacker looks around the account, then searches SharePoint to find what's worth taking.
5. They download from SharePoint, OneDrive, Exchange and other connected services, then use the data to extort the company.

Arctic Wolf found hundreds of lookalike subdomains. Most targets were US organizations in construction and engineering, healthcare and pharma, real estate, finance and professional services. Executives, including directors and vice presidents, were the most frequent targets.

So what for your business

Nothing here is a software flaw. The attacker is borrowing a person's trust and a real sign-in. That's why training alone won't fix it. A busy executive will sometimes say yes to a polite call from "IT".

The better question is what happens after someone says yes. If a stolen session can quietly download everything in SharePoint, the blast radius is your design choice, not the attacker's.

What to do this month

1. Move to phishing-resistant sign-in. Passkeys and hardware keys can't be relayed through a fake page the way a pushed approval can. Start with executives and admins.
2. Agree a callback rule. IT never asks for a login or an approval on an inbound call. If staff are unsure, they hang up and call the published help-desk number.
3. Tighten conditional access. Challenge or block sign-ins from hosting and proxy networks, and from devices you don't manage.
4. Shrink what one account can reach. Review who has broad SharePoint access and remove what isn't needed.
5. Alert on bulk downloads. Large volumes of file downloads or mailbox reads from one session should page someone.