Lure domains include mfaregister[.]com and setpasskey[.]com, and the campaign singles out directors and vice presidents at healthcare and pharmaceutical firms.

 

What happened

A data theft and extortion cluster tracked as PREY-0058 is calling employees while posing as internal IT staff, then directing them to authentication-themed web addresses built to capture Microsoft 365 sessions, The Hacker News reported on September 7, 2026. Targets are concentrated among directors, vice presidents, and other executives at US organizations, with healthcare and pharmaceuticals among the five sectors most affected alongside construction and engineering, real estate, finance, and professional services. Lure domains follow a consistent theme, including mfaregister[.]com, setpasskey[.]com, passkeydeploy[.]com, nowsso[.]com, and registermymfa[.]com. Each URL is constructed as the victim organization's name followed by the lure domain, and researchers found hundreds of subdomains impersonating real companies.

 

Going deeper

An employee who has been told their organization is rolling out passkeys, or who has recently been prompted to re-register multi-factor authentication, has a reason to accept that a domain containing those words is legitimate. From there, the victim reaches an adversary-in-the-middle login flow, where the attacker's server relays traffic to genuine Microsoft infrastructure while copying the credentials, the multi-factor approval, and the resulting session token. Those tokens are replayed from proxy infrastructure resolving to the same city and network provider as the victim, which removes location as a signal. Sign-in activity starts with applications named My Signins, My Profile, and My Apps, which show the attacker what the account is and what it can reach. What follows is discovery against SharePoint and Entra ID, then bulk collection from SharePoint, OneDrive, Exchange, and Box, and finally an extortion demand.

 

What was said

"Defenders can disrupt this activity by detecting anomalous residential-proxy token replay, SharePoint discovery and bulk access, mailbox harvesting, and newly registered authentication-themed lure infrastructure," researchers Steven Campbell, Trevor Daher, Stefan Hostetler, and Joshua Riccio wrote in their analysis, reported by The Hacker News. They documented SharePoint discovery appearing in logs as search query events against site and web content classes, with wildcard searches used to page through results.

 

In the know

PREY-0058 shares substantial tradecraft with a cluster Mandiant tracks as UNC6671, and researchers also assess that an extortion operation called Cinder likely represents a rebrand or continuation of one called Pink, based on overlap between the organizations listed on their respective leak sites. Google indicated last month that these labels do not correspond to a single proven identity, describing instead an amorphous population of affiliates, splinter crews, and groups sharing the same underlying phishing infrastructure. For a security team, that means a threat intelligence report naming one group may describe activity another report attributes elsewhere, and defending against the technique matters more than matching the name.

 

The big picture

No malware is deployed anywhere in this chain, and no lateral movement occurs across the network, which removes the signals most detection programs are built around. Endpoint tools have nothing to find, and the account activity resembles an executive working normally from their usual location. Researchers advise organizations to implement conditional access policies, deploy phishing-resistant multi-factor authentication, restrict the scope of data users can reach in SharePoint, and train both employees and help desk staff on voice phishing, according to The Hacker News. Limiting SharePoint scope is the control that caps what a successful compromise yields, since bulk collection from document libraries is where the extortion material comes from. Detection sits at the identity and application layer rather than the endpoint, watching for a single session appearing from multiple network providers, unusual query volume against document libraries, and newly registered domains carrying authentication themes.

 

FAQs

Why would attackers target directors and vice presidents specifically?

Executive accounts typically hold broader access to shared document libraries and correspondence containing commercially sensitive material, which is what an extortion operation needs. Those accounts also carry authority, so requests originating from them face less scrutiny.

 

What makes a passkey-themed lure domain effective?

Organizations rolling out passkeys or new authentication methods send employees legitimate enrollment communications, so a message about registering multi-factor authentication fits an expected pattern. The domain name itself provides the plausibility that a generic phishing domain would lack.

 

How does an organization detect residential proxy token replay?

Compare the network provider and address associated with each session against the account's established pattern, and alert when a single session identifier appears from more than one provider. Location alone is insufficient here, since the proxies resolve to the victim's own area.

 

What is SharePoint discovery and why does it appear in logs?

Attackers query SharePoint to map which sites and libraries an account can reach before downloading anything. Those queries generate search events that differ from ordinary user behavior in volume and pattern, which makes them detectable if anyone is reviewing them.

 

Does an incident with no malware still require breach analysis under HIPAA?

Yes. The obligation turns on whether protected health information was accessed or acquired without authorization, not on whether malicious software was present. An attacker reading and downloading files from SharePoint or Exchange has done exactly that.