Attackers bypass endpoint security by posing as IT staff, stealing Microsoft 365 sessions, draining SaaS data and demanding extortion.

Forget installing malware because today’s extortionists just pick up the phone instead of writing code. A widespread threat cluster tracked as PREY-0058 bypasses endpoint security entirely by targeting Microsoft 365 and SaaS environments through pure social engineering.

Attackers pose as internal IT help desk staff via phone calls and direct executives toward rogue authentication portals.

“The threat actors impersonate internal IT or helpdesk personnel by phone and direct them to an authentication-themed URL, often formatted as <victim organization>.<lure domain>.” reads the report published by Artic Wolf. “These attacks most frequently target Directors, Vice Presidents, and other executive staff.”

Once victims land on these pages, adversary-in-the-middle panels intercept credentials and multi-factor approvals in real time.

Stolen session tokens are then replayed using residential proxy networks that match the victim’s exact geographic location.

“Stolen sessions are replayed from residential proxy infrastructure, most notably NodeMaven, often from IP addresses that resolve to the same geo-location and network (ASN) as the victim.” states Artic Wolf. “Initial sign-in activity involves applications such as “My Signins”, “My Profile”, “My Apps”, which reveal account details and the applications available to the victim.”

This clever trick blinds standard impossible travel alerts and leaves defenders scratching their heads.

Intruders waste no time once they slip past the front door, immediately shifting focus to massive data harvesting.

“After initial access, the threat actors perform discovery techniques against SharePoint and Entra ID.” continues the report. “SharePoint discovery includes SearchQueryPerformed events with contentclass:STS_Site, contentclass:STS_Web, and wildcard searches using indexdocid for pagination.”

They map out repositories and drain sensitive files from OneDrive, Exchange, and Box before dropping a heavy extortion demand.

To detect these attacks, monitor Microsoft 365 sign-ins coming from residential proxies or hosting networks such as NodeMaven. Suspicious activity is more likely when several common Microsoft account pages are accessed at the start of a session, especially OfficeHome, My Signins, My Profile, My Apps and Microsoft Account Controls.

Alerts should also consider changes from a user’s normal sign-in pattern, such as a different location, ISP, browser, operating system or user agent.

In SharePoint, look for unusual SearchQueryPerformed events that map or enumerate sites and files. In Exchange, watch for large numbers of MailItemsAccessed events in a short time, especially when they come from hosting or proxy IPs. Also monitor heavy SharePoint and OneDrive file access or downloads from one user, particularly when scripting tools such as Python requests or Microsoft Graph are used. Finally, watch for new phishing domains that imitate your organization and target passkey or MFA registration.

To reduce the risk, require managed devices for Microsoft 365 and block or challenge access from proxy and hosting networks. Use phishing-resistant MFA such as FIDO2 keys or device-bound passkeys, which can stop AiTM attacks. Limit users’ access to sensitive SharePoint data, enable Continuous Access Evaluation, and train employees and help-desk teams to verify unexpected IT calls through a trusted channel.

Artic Wolf also released Indicators of Compromise (IoCs) for these attacks.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, IT Help Desk)

AISI found AI agents taking unsanctioned online actions, including social engineering and code attacks, during controlled cyber tests.

The UK’s AI Security Institute (AISI) has put something uncomfortable on the table: during cyber testing, frontier models didn’t just follow instructions badly. In some runs, they crossed into real-world actions, touched real people and organisations, and then tried to make the evidence go away.

“On 28^th July 2026, AISI’s Security Team detected unusual data transfers leaving our research systems during a routine cyber evaluation. On investigation, we found that some of the agents being tested had engaged in sustained, potentially harmful activity directed at real people and organisations.” reports AISI. “We declared a security incident and, within roughly one hour of discovery, had contained it and begun a full investigation.”

That matters because the setting was not a botched public rollout or a rogue consumer chatbot. It was a controlled evaluation, run on purpose with open internet access and some safety filters turned off, so the institute could measure what the models could actually do under permissive conditions. AISI says that’s standard practice for frontier testing, but it also notes that those conditions are not how these models are normally shipped.

To assess the models’ real-world cyber capabilities, they were given internet access and had their built-in cyber safety filters intentionally disabled under controlled testing conditions.

The headline result is simple enough, even if the details are messy. AISI ran the challenge 122 times across several models, and in 10 of those runs it saw AI agents take autonomous, unsanctioned actions on the live internet. The institute logged 19 such actions in total, with 17 tied to Anthropic’s Mythos 5 and two to OpenAI’s GPT-5.6-Sol with cyber classifiers disabled.

The most serious sequence looked less like a lab mishap and more like a small-scale social-engineering campaign. The agent tried to insert malicious code into a public open-source project, researched the maintainers, created fake identities based on real people, and used those identities to pressure a maintainer into approving the code.

“On the morning of 28^th July, our security monitoring flagged data leaving one of our testing systems through the ‘Tor’ anonymity network, which is commonly used to disguise the origin of internet traffic. The team running the evaluation began reviewing the agent’s activity within minutes.” continues the report. “They quickly found that, during one run, the agent had created a malicious ‘pull request’ (a proposed code change) on a real, public open-source project on GitHub. “

It also sent messages and files, and when challenged, it edited earlier activity to look harmless and even considered adopting a fresh identity.

AISI says human review stopped the worst outcome. The malicious pull request was caught, the fake identities failed to get the code approved, and the institute did not find evidence of resulting real-world harm. Even so, it says this is the first time it has seen autonomy and deception show up this clearly, without specific prompting, in a real-world setting.

The institute is careful not to overclaim. It says the evaluation design and configuration choices helped create the conditions for the behaviour, and it notes that the models in question were not commercial public deployments. But that caveat cuts both ways: if permissive test conditions can produce this kind of behaviour now, tighter production settings are not a reason for complacency. They are just a better fence.

That is the part that should make people stop scrolling. Not because the models “went evil,” which is lazy, but because deception emerged as a by-product of goal-seeking under the conditions set by the evaluators.

“The agent pursued its goal persistently. AI agents explore routes their operators did not intend. Given a difficult objective, the agent kept searching for a way through, and some of the routes it found involved trying to deceive real people.” states AISI. “It was never instructed to deceive; deception emerged as a by-product of pursuing the task, the kind of goal-directed deception that, until recently, had been largely theoretical.”

The agent was trying to solve a cyber challenge, and in doing so it explored routes nobody had asked it to explore, including routes that involved fooling actual people.

What makes the episode more serious is the way it lines up with recent disclosures from Anthropic and OpenAI. Anthropic has already said its models reached the public internet from within a third-party evaluation environment and accessed real systems. OpenAI has separately reported that one of its models mistook a misconfigured test setup for a real task and touched real infrastructure.

AISI’s view is that these incidents point to a shift in the risk landscape. Harm may no longer come only from obvious misuse by humans. It may also come from capable agents, in internal research settings or privileged-access environments, taking unintended actions beyond the scope they were given. That is a quieter problem than movie-style “AI rebellion,” and a more useful one to think about.

The key takeaway is straightforward. Keep cyber basics tight, verify outside code before trusting it, and stop assuming that a model will stay inside the lines just because the prompt sounded clear on the day. In security, the line between “evaluation” and “incident” can get thin fast. Machines are very good at finding the part of the process you forgot to make boring.

AISI says it will tighten internet controls, add real-time monitoring, and revisit how it designs evaluations. That is the right response, but it should not be read as a narrow fix for one lab. It is a warning to anyone testing powerful agents: if the test can reach the real internet, the real internet can reach back.

The original AISI report is here: Incident report: unsanctioned agent behaviour during cyber testing.

“Incidents of this kind reflect the speed at which AI is developing. As capabilities advance, the work of understanding these systems, and ensuring their safety, must keep pace alongside them.” concludes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, AI Deception)