Malware

Pink

A botnet with P2P and centralized C&C capabilities.

Indicators of Compromise 9

Domain assignpasskey[.]com Domain mfaregister[.]com Domain nowsso[.]com Domain oskeysetup[.]com Domain oursso[.]com Domain passkey-mfa[.]com Domain passkeydeploy[.]com Domain registermymfa[.]com Domain setpasskey[.]com

MITRE ATT&CK TTPs 8

T1020
Automated Exfiltration
Exfiltration
 T1059
Command and Scripting Interpreter
Execution
 T1078
Valid Accounts
Defense Evasion
 T1087
Account Discovery
Discovery
 T1133
External Remote Services
Persistence
 T1213
Data from Information Repositories
Collection
 T1530
Data from Cloud Storage
Collection
 T1566.002
Spearphishing Link
Initial Access

Source Articles

Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks
A threat cluster tracked as PREY-0058 by Arctic Wolf is conducting data theft and extortion attacks targeting Microsoft 365 users, primarily executives, through vishing (voice phishing) and adversary-in-the-middle (AitM) attacks. Attackers impersonate IT help desk personnel and direct victims to malicious authentication pages using domains that mimic legitimate services, such as 'mfaregister[.]com', to steal credentials and MFA tokens. These tokens are then replayed via residential proxy infrastructure to access Microsoft 365 services, enabling large-scale data exfiltration from SharePoint, OneDrive, Exchange, and Box without deploying malware or moving laterally within networks.
hacker-news ·17h ago