# The Executive Knows Your Name, Your Boss's Name, and Your IT Ticket Number
The call sounds completely legitimate. Someone from IT, professional tone, knows your name, references your recent login from an unusual location. Could you just verify your identity so they can secure the account? The whole thing takes four minutes. By the end, the attacker owns your Microsoft 365 session — and your company's data is already walking out the door.
This is the anatomy of a threat cluster that security researchers have now documented in enough detail to understand just how industrialized it has become. It targets executives specifically — directors, VPs, C-suite — and it chains together three techniques that, individually, defenders have learned to handle. Together, they punch straight through most enterprise security stacks.
## Why Executives, and Why Now
The short answer to "why executives" is that they have the access worth stealing. A VP of Finance's Microsoft 365 account doesn't just contain email — it typically connects to SharePoint libraries, Teams conversations with board members, financial systems integrated via single sign-on, and cloud storage with documents that carry real leverage for extortion.
There's a longer answer too. Executives are frequently carved out of security controls that would stop this attack cold. MFA fatigue campaigns and phishing-resistant authentication rollouts often stall at the C-suite because friction complaints get escalated to IT leadership. The same people being targeted by this campaign are, in many organizations, the ones who pushed back hardest against security measures.
The threat cluster exploits that gap with precision.
## The Three-Part Attack Chain
What makes this campaign technically notable is how the components reinforce each other. Vishing — voice phishing — opens the door. Adversary-in-the-middle token theft walks through it. Residential proxies keep the session alive without triggering location-based anomaly detection.
Step one: The call. Attackers phone the target posing as internal IT or an outsourced help desk vendor. The pretext varies, but common lures include security alerts about suspicious logins, MFA device resets, or account compliance reviews ahead of a software update. The social engineering here is not improvised — attackers come with enough internal knowledge to sound credible. This probably means some combination of OSINT from LinkedIn, prior credential breaches that exposed employee directories, or access to a corporate email account from an earlier compromise.
Step two: Token theft. This is where AitM infrastructure comes in. The goal isn't to get the executive's password — passwords alone are increasingly useless against MFA-protected M365. Instead, the attacker convinces the target to authenticate through a proxy site that relays the login to Microsoft in real time, capturing the session token after MFA is satisfied. The user successfully completes authentication. Microsoft sees a valid login. The attacker walks away with a token that remains valid for hours or days depending on conditional access policy configuration.
Step three: The clean sign-in. Raw datacenter IPs trigger alerts. Residential proxies — sourced from botnet infrastructure or commercial services built on compromised home devices — look like normal user traffic. The attacker uses a residential IP geographically consistent with the victim's typical login location, and most SIEM rules never fire.
The result is authenticated access to the M365 environment that looks, to most monitoring tools, like a late-evening session from someone working from home.
## What They Do Once They're In
Data exfiltration comes first. Attackers map SharePoint, Teams, and OneDrive for high-value material — financial records, M&A documents, personnel files, anything with leverage. They're not necessarily trying to encrypt and ransom. The play here is often straight extortion: pay or we publish the CFO's acquisition strategy, the board's litigation discussion, the HR investigation into a senior employee.
Email access opens secondary vectors. With an executive's inbox, attackers can initiate BEC fraud downstream — instructing finance teams to wire funds, changing payment details on vendor accounts, or impersonating leadership in internal communications to escalate privileges elsewhere in the environment.
Some incidents in this cluster have involved the attackers calling target organizations' IT teams *as the executive*, using the compromised session as proof of identity to make changes — password resets, MFA device swaps, account recovery requests — that further entrench access.
## What Defenders Actually Need to Change
The uncomfortable reality is that most organizations already have defenses that *should* stop this. Phishing-resistant MFA (FIDO2/hardware keys) breaks the AitM token theft entirely. Conditional access policies with strict device compliance requirements shrink the residential proxy problem. Neither of these is new guidance.
The implementation gap is the problem. A few concrete places to focus:
---
## HackWire Analysis
This campaign deserves more attention than it's getting because it illustrates something security teams have struggled to communicate upward: the attack surface that executives worry about (ransomware on servers, data breaches via SQL injection) is not the same attack surface being actively exploited against them.
Vishing has been around for decades. AitM proxies became mainstream conversation after the Evilginx and Modlishka toolkits lowered the barrier to entry around 2018-2019. Residential proxy abuse for location spoofing is older still. What's new here isn't the individual techniques — it's the operational sophistication of combining them into a workflow that specifically hunts organizational hierarchy.
This mirrors a pattern we saw emerge in BEC operations around 2020-2022, where attackers moved from broad credential phishing to targeted executive impersonation because the return on investment was dramatically higher. The same economics apply here. Breaching one VP's account through this chain is worth more than a thousand phished employee credentials, and the attack requires roughly comparable effort once the infrastructure is built.
The industries most exposed right now are financial services, healthcare, legal, and private equity — anywhere that executive-held documents carry obvious extortion value and where regulatory disclosure requirements create additional leverage for attackers threatening to notify regulators themselves.
One thing most coverage is missing: the residential proxy layer suggests either significant criminal infrastructure investment or affiliations with established cybercrime-as-a-service operations. This isn't a one-off group. The tooling indicates something organized enough to commoditize.
The fix is FIDO2. Full stop. Organizations still relying on TOTP or push-based MFA for executive accounts are running a policy gap that this campaign was built to exploit.
— HackWire Editorial
---
## Related Coverage