IT Help Desk Impersonation Hack Bypasses MFA Protections
Social engineering attacks exploit human trust to hijack Microsoft 365 sessions via fake IT calls.
1Attack Methodology
Hackers impersonate IT help desk staff via phone calls, directing executives to fake authentication portals. These spoofed pages capture credentials and MFA approvals in real-time through adversary-in-the-middle attacks. The PREY-0058 threat group specifically targets directors and VPs, knowing they have broad access rights. Attackers use residential proxy networks like NodeMaven to replay stolen sessions from matching geographic locations.
2Technical Execution
Initial sign-ins focus on Microsoft account pages like 'My Signins' and 'My Profile' to gather intelligence. Attackers then perform extensive discovery in SharePoint using specific search queries (contentclass:STS_Site) and wildcard searches. The hackers systematically map out and exfiltrate data from OneDrive, Exchange, and Box before making extortion demands. This approach bypasses traditional 'impossible travel' security alerts.
3Detection Indicators
Security teams should monitor Microsoft 365 sign-ins from residential proxies or hosting networks. Suspicious patterns include accessing multiple account management pages at session start. Unusual SharePoint SearchQueryPerformed events that enumerate sites/files warrant investigation. In Exchange, watch for bursts of MailItemsAccessed events from proxy IPs. Large OneDrive downloads using scripting tools like Python requests are red flags.
4Defensive Measures
Organizations should require managed devices for Microsoft 365 access and block traffic from known proxy networks. Implementing phishing-resistant MFA like FIDO2 keys can prevent these attacks. Limiting SharePoint access and enabling Continuous Access Evaluation adds protection layers. Help desk teams need training to verify unexpected IT requests through established channels. Artic Wolf has published specific IoCs for detection.
5Attack Sophistication
This campaign represents a shift from malware-based attacks to pure social engineering. By exploiting human trust rather than technical vulnerabilities, attackers bypass endpoint security completely. The use of geo-matched residential proxies makes detection exceptionally challenging. Attackers demonstrate deep knowledge of Microsoft 365's architecture and common security blind spots.
6Target Profile
Executives are primary targets due to their broad access privileges and authority. Directors and VPs often have access to sensitive financial, strategic, and personnel data. Their frequent travel schedules make unusual login locations less suspicious. The personal nature of help desk calls lowers victims' defenses compared to email phishing attempts.
7Industry Impact
The attacks particularly affect technology, financial services, and healthcare sectors where Microsoft 365 is widely adopted. Organizations with distributed workforces are more vulnerable due to reliance on cloud collaboration tools. The campaign highlights growing risks in SaaS environments where traditional network security controls are ineffective against social engineering.
8Strategic Implications
This attack vector demands a fundamental rethink of identity protection strategies. As MFA becomes standard, attackers shift to intercepting authentication flows rather than bypassing them. Security teams must balance user experience with protection, especially for mobile executives. The incidents underscore that people remain the weakest link in cybersecurity defenses.
Original article: Security Affairs — IT Help Desk Impersonation Hack Bypasses MFA Protections