The Phone Call Is the Exploit
Arctic Wolf researchers published details on September 7, 2026 of a campaign it tracks as PREY-0058, which shares enough overlap with activity Mandiant tracks separately as UNC6671 that the two are likely connected or coordinated. The technique at the center of this campaign is voice phishing, plain phone calls, aimed specifically at executive-level personnel: directors, vice presidents, and other leadership roles across construction and engineering, healthcare and pharmaceuticals, real estate and property management, finance, and professional services firms in the United States.
Targeting executives rather than help desk staff or general employees is a deliberate choice. Senior leaders typically carry broader access permissions, get less frequent security awareness reinforcement than frontline staff, and are more likely to be genuinely confused by an unfamiliar IT process during a busy day, which makes them more compliant when a caller sounds confident and references real internal terminology. The entire campaign depends on a human being willing to follow instructions over the phone, which means no amount of endpoint detection tooling addresses the actual point of failure.
How Multi-Factor Authentication Gets Bypassed, Not Broken
The technical core of PREY-0058 is adversary-in-the-middle token theft. Rather than trying to guess or steal a password, which MFA is specifically designed to make useless on its own, the attackers direct victims to what looks like a legitimate authentication flow, one that actually proxies through infrastructure the attacker controls. The victim completes their normal login, including their MFA approval, and the attacker's proxy captures the resulting session token in real time. That token grants the same access a valid login session would, and MFA never gets a second chance to catch it because the token represents an already-completed authentication.
The campaign uses proxy infrastructure identified as NodeMaven to replay these stolen sessions in a way built to defeat geographic and device-based anomaly detection. If your organization's security stack flags logins from unfamiliar countries or unrecognized devices as suspicious, and stops there, this campaign is specifically engineered to slip past that control. Session replay through matched proxy infrastructure means the login can appear to originate from a location and device profile consistent with the victim's normal pattern, denying defenders the easy signal they are used to relying on.
Quiet Reconnaissance Before the Smash and Grab
Once inside a compromised account, Arctic Wolf's researchers observed the attackers moving methodically rather than immediately grabbing data and running. Initial sign-in activity involves applications like My Signins, My Profile, and My Apps, native Microsoft account management pages that reveal account details and the full list of applications available to the victim. That is reconnaissance, mapping what access the compromised identity actually grants before deciding what to take, and it happens using entirely legitimate Microsoft interfaces that generate no alarming security telemetry on their own.
From there, the group expands into SharePoint and Entra ID discovery, building a picture of the broader organizational structure and where valuable data actually lives, before moving to bulk exfiltration from SharePoint, OneDrive, Exchange, and Box. Extortion demands follow the data theft. This is a deliberate, staged operation with distinct phases, not a smash-and-grab, and each phase generates activity that looks unremarkable in isolation, which is exactly what makes the full sequence hard to catch through any single detection rule.
Why Help Desk Identity Verification Is the Real Gap
This campaign is the latest in a pattern security researchers have flagged repeatedly over the past two years: help desk social engineering has become one of the most reliable initial access techniques against large enterprises, precisely because most organizations still verify caller identity using methods, employee ID numbers, birth dates, manager names, that are trivially available through prior data breaches, LinkedIn, or basic reconnaissance. A caller who has done ten minutes of research on a target executive can usually pass whatever verification questions a help desk script asks.
The uncomfortable reality is that most enterprise identity verification protocols for help desk interactions were designed for a threat model that assumed low attacker sophistication and low stakes per call. PREY-0058 targets executives specifically because a single successful call yields disproportionate access. Fixing this requires a verification process that does not rely on information an attacker can look up, callback procedures to a number on file rather than one the caller provides, and phishing-resistant authentication methods like hardware security keys that cannot be relayed through an adversary-in-the-middle proxy no matter how convincing the phone call was.
The Decision for Every CISO This Quarter
If your organization has not audited its help desk identity verification process against a scenario where the caller already knows your employee ID format, your org chart, and your internal terminology, that audit needs to happen now, not after your organization becomes the next confirmed PREY-0058 victim. The specific sectors named in this disclosure, construction, healthcare, real estate, finance, and professional services, are broad enough that most enterprise readers of this piece sit inside the target profile whether or not their industry got an explicit mention.
The higher-leverage fix is architectural: moving toward phishing-resistant authentication, FIDO2 security keys or platform passkeys, for any account with elevated access removes the adversary-in-the-middle token theft path entirely, regardless of how convincing the social engineering gets. That is a heavier lift than a policy memo, and it is the difference between a campaign like this one working on your executives or bouncing off them, which is the actual return on the investment.
