Arctic Wolf Releases Cordial Spider/PREY-0058 Report of IT Help Desk Vishing for Cloud Data Theft and Extortion
Wed Sep 09 2026
Cybercrime
Phishing
SaaS
Social Engineering
rhisac.org
Executive Summary Arctic Wolf is tracking a widespread data theft and extortion threat cluster designated as PREY-0058, also known as Cordial Spider and the previously-mentioned UNC667, above. This activity, detailed in a GitHub blog post published on 4 September 2026, targets Microsoft 365 and other SaaS services through IT help-desk vishing, adversary-in-the-middle token theft, and residential-proxy sign-ins. Analysis of...