There is a phone call, claiming that he/she represents IT. The website where you have to go bears your company name and ends with something like setpasskey or registermymfa. Nothing seems odd here. Security teams have consistently advised people to adopt passkeys as a security upgrade.
This is the bait. The address appears to be related to the installation of a better login procedure, which is how the account becomes compromised.
What is PREY-0058? PREY-0058 is a cluster of threats involving a phone call made to executives, representing internal IT. The fabricated Microsoft 365 login page then tricks the victims into using it and obtains the session token. From there, the attackers use no malware; instead, they replay the session token to access mailboxes and SharePoint sites, after which they begin the extortion process.
The Lure Looks Like A Security Upgrade
Every lure domain carries the tell. assignpasskey[.]com, registermymfa[.]com, oskeysetup[.]com, passkeydeploy[.]com and setpasskey[.]com all appear in this campaign.
The operators use these domains as wildcards and therefore prepend the victim company’s name to them as a subdomain. It comes across as yourcompany.registermymfa[.]com. Pronounced as a part of the conversation during a technical support call, it gives the impression of being an internal application.
There are hundreds of these subdomains that impersonate genuine organizations. However, behind all of this, an operator manually operates the phishing panel and takes each victim separately through the process of credential harvest.
The attackers have carefully chosen the targets. Executives like directors and vice presidents and IT professionals are the main targets. Specifically, they are mostly from the United States and work in sectors including construction & engineering, health care & pharmaceuticals, real estate and finance/professional services.
Why The Stolen Login Never Looks Stolen
It’s only the beginning but not the end. What the operators do is using the authenticated session token after the victim has passed MFA.
Using this token elsewhere is what triggers the alert. The classic impossible travel scenario would be the sign-in from some other country shortly after the real one.
So the attackers reuse this token by means of residential proxies. The addresses used would resolve to the same location and network as the victim. NodeMaven is the proxy provider found in the majority of studied cases out of eight. There is always just one address per session without any rotation and rate limiting which is what reveals automation.
If the match was successful, the log contains the sign-in from the right location and the right ASN. There is also an MFA event which is approved by the user. Nothing is anomalous about this, since nothing is.
The Session Is Spent Reading
Mailboxes are collected using Microsoft’s very own web client app for Outlook, creating many MailItemsAccessed events.
The SharePoint discovery is conducted in a methodical manner. Queries with broad scope using contentclass:STS_Site find all sites accessible by the account, followed by contentclass:STS_Web to find subsites below them.
Wildcard search finds the documents while the operators use indexdocid to navigate results greater than the amount that can be returned at once. Downloads occur after the mapping.
In the past, python-requests was present in user agent strings. In recent cases, Chrome versions are faked instead. This seems to be an attempt to blend with normal browsing.
OneDrive and Box are harvested similarly.
No Malware Means No Endpoint To Watch
No installation occurs. There is neither any endpoint malware nor any lateral movement throughout the network.
The reason why this point is important is that endpoint tooling detects intrusions because attackers run code where they should not, but here they run no code at all.
All the actions are legitimate API calls using a legitimate token and from an address corresponding to the user. The only thing that indicates this attack is the volume and pattern, which are found in cloud logs.
We saw the endpoint signal disappear the same way when a phishing service spoofed a conferencing brand to capture Microsoft 365 sessions. Delivery changed. The outcome did not.
Four Brands, One Intrusion Crew
Extortion emails go to the victim’s executives, carrying TOX contact details and a threat of public leaks. Recipients get 72 hours to respond and an offer of sample files as proof of possession.
They do not encrypt or destroy data. Victims do not need to purchase a decryptor or restore anything since this attack does not require a recovery process as in a typical ransomware event.
The operators use different names including BlackFile, Redact, Pink and Helix. There is a fifth name that we have with moderate certainty to be a rebranding or continuation of Pink called Cinder.
What The Logs Cannot Tell You
There are two questions that arise in such an event, and only one of them actually has an answer.
Downloads made are answerable since audit logs from the cloud capture the downloads in question once a user examines them.
As to what the session in question could have accessed, that one is much more difficult. There was a token representing all the rights of the user, and considering that we speak about an executive, there were many of those, established over many years.
Therefore, access control has to become part of the discussion around the detection of the incident rather than the enforcement. In contrast, the latter is about capturing what happened while the former defines what an authenticated session could have touched beforehand.
Conclusion: When Authentication Is Real but Access Is Not
The defining lesson from PREY-0058 is that successful MFA does not prove the resulting session remains in the hands of the legitimate user.
The operation begins with a phone call, not malware. Attackers impersonate internal IT and direct selected executives or IT staff to company-themed domains presenting what appears to be a passkey or MFA enrollment workflow. The victim enters legitimate credentials and approves the genuine authentication challenge. The attacker then captures the authenticated Microsoft 365 session and replays it from residential proxy infrastructure designed to resemble the victim’s normal location and network.
From that point forward, the activity can look frustratingly legitimate. The attackers access Outlook, SharePoint, OneDrive, Entra ID, and other SaaS services using valid cloud interfaces and an already-authenticated identity. They read mailboxes, map accessible sites, download files, and use the stolen data as leverage for extortion. They do not need to run ransomware or infect any endpoint.
Why This Threat Matters
- MFA can succeed while the session still changes hands. In other words, the user legitimately completes authentication, but the resulting session token becomes attacker-controlled.
- Attackers can deliberately weaken location-based anomaly detection. Residential proxies matching the victim’s geography and ASN reduce obvious impossible-travel signals.
- The token inherits the user’s existing reach. Executive accounts may carry years of accumulated access to mailboxes, SharePoint sites, files, and other SaaS resources.
- Cloud-native activity can look normal. Outlook and SharePoint access through legitimate interfaces produces fewer obvious signals than malware or remote tooling on an endpoint.
- There is no encryption event to announce the breach. Attackers can quietly collect data and later use it for extortion without disrupting systems.
- The security-upgrade theme strengthens the lure. Passkey and MFA enrollment are familiar defensive processes, which makes fake IT guidance around them especially credible.
Where Defensive Control Must Operate
Defense must operate at both the social-engineering and identity layers.
Xcitium Cyber Awareness Education and Phishing Simulation help users recognize fake IT calls, unexpected authentication enrollment requests, and company-branded domains that only appear legitimate.
Once authentication has occurred, Xcitium ITDR becomes the primary defensive layer, helping surface abnormal session reuse, unfamiliar access infrastructure, privileged identity activity, and post-authentication behavior that no longer matches the legitimate user.
Revoke the Session, Not Just the Password
When you suspect this attack, password reset alone is incomplete because the attacker may already possess an authenticated session. Therefore, recovery should include revoking active sessions and tokens, reviewing MFA and passkey registrations, examining recent cloud sign-ins, and investigating mailbox, SharePoint, OneDrive, and directory activity performed during the exposure window.
PREY-0058 demonstrates the real boundary clearly. Authentication can be genuine while an attacker still controls the access. Therefore, the critical question is not only who passed MFA, but who controls the session afterward.
