type: incident · created: 2026-09-08 · updated: 2026-09-08 · tags: [incident, vishing, phishing, extortion, microsoft-365, unc6671] · confidence: high · affected_sectors: [technology, finance, legal] · au_impact: true
Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion
Researchers documented an identity-phishing cluster — tracked as PREY-0058, aligned with UNC6671 — conducting fake-IT-helpdesk vishing campaigns targeting senior executives, leading to Microsoft 365 data theft and extortion.
| Attribute | Detail |
|---|---|
| Vector | Vishing (fake IT helpdesk) |
| Target | Senior executives |
| Outcome | M365 data theft and extortion |
| Tracking | PREY-0058 (aligned with UNC6671) |
| Source | The Hacker News — Tier 2/4 |
The cluster monetises the same identity/MFA weakness as BigBear 2.0's phishing-as-a-service — session hijack and token theft rather than brute-forcing. It reinforces the need for phishing-resistant (FIDO2/passkey) authentication and scrutiny of credential-reset or help-desk calls.
Related Pages
- Unc6671 Vishing Attacks Target Personal Phones To Steal Saas Data — the broader UNC6671 vishing campaign