Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks

Threat hunters disclosed details of a widespread data theft and extortion threat cluster targeting Microsoft 365 and other SaaS offerings through IT help desk vishing, adversary-in-the-middle token theft, and residential-proxy sign-ins. The activity mainly singles out directors, vice presidents, and other executive staff.