Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks

Threat hunters have disclosed details of a widespread data theft and extortion threat cluster that's targeting Microsoft 365 and other software-as-a-service (SaaS) offerings through information technology (IT) help desk vishing, adversary-in-the-middle (AitM) token theft, and residential-proxy sign-ins. The activity, which mainly singles out directors, vice presidents, and other executive staff

The article reports a data-theft and extortion campaign against Microsoft 365 and other SaaS offerings using IT help desk vishing, adversary-in-the-middle token theft, and residential-proxy sign-ins, with executives such as directors and vice presidents singled out. This is a factual report of account-compromise and SaaS-targeting activity, not an AI-specific intrusion. RealGround analysis: the primary security implication is stronger identity verification, token/session protection, and executive-focused SaaS controls to reduce the risk of account takeover and data exfiltration.