Executive-Targeted Microsoft 365 Extortion Campaign Leverages IT Help Desk Vishing and AitM Token Theft

According to threat hunter disclosures reported by The Hacker News, a widespread data theft and extortion threat cluster has been targeting Microsoft 365 and other software-as-a-service (SaaS) offerings. The attack methodology combines three distinct techniques: information technology (IT) help desk vishing, adversary-in-the-middle (AitM) token theft, and residential-proxy sign-ins.

The campaign initiates with vishing (voice phishing) calls directed at IT help desks. Threat actors socially engineer help desk personnel into resetting passwords or enrolling in MFA, thereby gaining initial access to executive-level Microsoft 365 accounts. Once access is established, the attackers employ AitM proxies to intercept session tokens, allowing them to hijack active sessions without needing credentials.

To maintain persistence and evade detection, the actors use residential-proxy sign-ins. By routing sign-ins through residential IP addresses, the attackers mask their true origin and bypass geolocation-based MFA prompts that would otherwise flag suspicious activity. The primary targets are directors, vice presidents, and other executive staff, with the objective of data theft and subsequent extortion.

The report notes that specific threat actor attribution, exact victim counts, and detailed extortion demands remain unconfirmed and are based on threat hunter reports. The activity is described as widespread, though geographic victim distribution is not specified in the source material.