NodeMaven

PREY-0058 phones executives to harvest Microsoft 365 session tokens

Arctic Wolf says the cluster it tracks as PREY-0058 deploys no malware at all. A call from fake IT leads to a proxied login page, and the stolen session token comes back from inside the victim's own ASN.