Active Cloud Data Theft and Extortion Campaign Targeting Microsoft 365 and SaaS Platforms

Reported 10 Sep 2026 by otx · Severity: medium

A widespread IT impersonation and voice-phishing campaign designated PREY-0058 is actively targeting Microsoft 365 and SaaS platforms. Threat actors impersonate IT helpdesk staff via phone or text to trick executives and senior personnel into divulging credentials through adversa