As reported by SecurityAffairs, Arctic Wolf has published findings on threat cluster PREY-0058 that should reframe how security teams think about their perimeter. The attack chain is elegant in its simplicity: phone-based impersonation of IT staff, adversary-in-the-middle credential harvesting, and session token replay through geographically matched residential proxies. No payload. No detectable malware footprint. Just social engineering and identity abuse.
Why This Matters More Than Your Latest CVE
Defenders have spent years hardening endpoints, deploying EDR, and closing software vulnerabilities. PREY-0058 renders much of that investment irrelevant by operating entirely above the traditional detection layer. The attack surface here isn't a misconfigured server — it's human trust and identity session mechanics. This is the logical evolution of the AiTM phishing trend we've tracked since 2022, but the addition of residential proxy infrastructure matched to victim ASN and geography is what makes this campaign particularly insidious.
The traditional impossible-travel alert — a cornerstone of identity monitoring — is neutralized when the attacker's IP resolves to the same city and ISP as the victim. This isn't a future threat; it's a broken detection assumption.
Who Is at Risk
The Detection Gap Defenders Must Close
The report highlights specific telemetry that matters: SearchQueryPerformed events with contentclass:STS_Site or contentclass:STS_Web in SharePoint, and abnormal volumes of MailItemsAccessed events in Exchange. But reactive monitoring isn't enough. The initial sign-in pattern — where attackers access My Signins, My Profile, My Apps, and OfficeHome early in a session — is a behavioral fingerprint that deserves its own alerting logic, independent of IP reputation.
Shield53 Recommendations
Immediate Actions
- Implement number-matching MFA — push-based MFA without number matching is vulnerable to AiTM relay; require it universally for all executive accounts
- Enforce session token binding and shorter lifetimes — configure Conditional Access to limit session duration to 1-4 hours for privileged accounts and require reauthentication for sensitive actions
- Block or flag residential proxy traffic — integrate threat intel feeds that identify known residential proxy exit nodes (NodeMaven and similar) at the sign-in layer, not just at network egress
- Establish a verified internal communication protocol — IT should never initiate unsolicited credential resets or MFA re-enrollment by phone without a verifiable ticket number and callback mechanism
Strategic Hardening
- Deploy phishing-resistant authentication — FIDO2 hardware keys or platform-authenticated passkeys eliminate the AiTM relay vector entirely for session token theft
- Restrict SharePoint search via RBAC — limit wildcard and enumeration-capable search to content administrators; default users shouldn't be able to map the entire tenant
- Create behavioral session baselines per user — alert when a session begins with account-management pages rather than business applications, especially for executive accounts
- Train executives specifically — they're the target demographic; generic phishing training isn't sufficient when attackers are crafting organization-specific lure domains
The broader implication is clear: identity is the new perimeter, and session tokens are the new credentials. Until organizations treat session theft with the same urgency as credential compromise, campaigns like PREY-0058 will continue to succeed with nothing more than a phone call and a convincing URL.
