passkeyhelpdesk[.]com

Microsoft has disclosed details of two campaigns in which threat actors are abusing third-party email delivery infrastructure to blast financial fraud scam messages and using passkey-themed social engineering to breach cloud environments. The first campaign, per the tech giant, involved sending over a million scam emails between August 3 and 5, 2026, by masquerading as chief executive officers (CEOs) of various target companies, aiming to persuade accounts payable departments at those firms to initiate Automated Clearing House (ACH) transfers for a supposed ServiceNow annual subscription. Evidence indicates that the operators behind the campaign have leveraged generative artificial intelligence (AI) to facilitate the creation of email templates and draft emails tailored to their recipients. The activity primarily singled out enterprise users in the U.S., spanning IT services, consumer goods, real estate, and discrete manufacturing sectors. "The campaign follows steps before and during the execution of the campaign: threat actors register impersonation domains, send executive-themed payment requests through trusted infrastructure, embed fabricated invoices and supporting conversations, and attempt to convince finance personnel to initiate ACH transfers," the Microsoft Security Research team said. "Unlike traditional invoice scams that rely on a single social engineering lure, this campaign layered executive impersonation, vendor branding, fabricated invoices, and supporting email conversations into a unified narrative intended to reduce recipient skepticism." The spoofed email messages contained a purported "approval" of the fake invoice to trick recipients into making payments to attacker-controlled accounts. To lend a veneer of legitimacy to the deception, the threat actor included a forged email thread along with the fabricated invoice. In a clever twist, the attackers identified CEOs, CFOs, and presidents at victim organizations and plugged their names and email addresses into the emails' signatures so that they look convincing to the targets. The campaign also heavily relied on bogus domains and content designed to impersonate trusted brands and individuals. Some of the registered domains are below - service-nowinc[.]com domainlify[.]net Passkey-Themed Social Engineering Leads to Cloud Compromise The second campaign documented by Redmond revolves around cloud-based intrusions targeting multiple accounts in which suspicious sign-ins are followed by the threat actors adding their own authentication methods, as well as high-volume Microsoft Graph activity, SharePoint and OneDrive downloads, and mailbox collection through REST APIs. The activity, which has been detected since May 2026, is consistent with "automated collection from compromised cloud identities using proxy-associated infrastructure," Microsoft said. The attack commonly begins with identity-focused social engineering. The threat actors call or message a user's personal phone number, while claiming to be from the organization's IT help desk and urging them to immediately update their passkey, multi-factor authentication (MFA), or single sign-on (SSO) configuration to avoid access disruptions. Unsuspecting employees are redirected to counterfeit websites that mimic the legitimate Microsoft sign-in experience via SMS messages sent to their personal devices. The end goal here is to use the pretext to guide them through adversary-in-the-middle (AitM) or device-code authentication flows and take control of their Microsoft accounts either by capturing the credentials or unknowingly granting access on the actor's behalf. "The actor appears to invest heavily in pre-attack research, likely gathering information about employees and organizational structure from public sources such as social networking and professional profiling platforms," Microsoft said. "In a smaller number of cases, actors take advantage of already compromised accounts to expand their reach" by sending similar passkey-themed messages via Microsoft Teams. What's more, the threat actor has been observed registering domains built around themes such as passkeys, SSO enrollment, account activation, and identity verification, at the same time including the target organization's name as a subdomain in the pattern: " . [.]com" - passkeyhelpdesk[.]com secure-passkey[.]com setupmypasskey[.]com add-passkey[.]com integratedsso[.]com oktasession[.]com syncmykey[.]com portalsetuphub[.]com It's worth noting that this modus operandi overlaps with a loose-knit cybercrime collective tracked by the cybersecurity community under the monikers Cordial Spider, O-UNC-045, PREY-0058, and UNC6671. The e-crime adversary has been described as a coordinated group of threat actors that operates multiple public extortion brands while sharing overlaps in the underlying phishing infrastructure and targeting footprint. "UNC6671 uses credential harvesting panels hosted on generic root domains masquerading as being related to passkeys, appending victim-specific subdomains to facilitate targeted voice phishing campaigns," Google-owned Mandiant noted last month. Although the exact nature of these connections is unclear, it's suspected that they have been driven by splintered affiliates retaining access to shared initial access playbooks or relying on the same commoditized phishing panels, voice-phishing callers, and shared infrastructure. Microsoft, for its part, has attributed the initial access activity observed in this campaign to a range of threat actors, including Storm-3121 and Storm-3032. While Storm-3121 carries out initial access activity leading to ShinyHunters and Falcon (aka CL-CRI-1182) extortion, Storm-3032 is its designation for UNC6671, which refers to a set of actors that broke off from the BlackFile (aka CL-CRI-1116) group and now operate under the Helix extortion brand. In at least one case investigated by Microsoft, the threat actors are said to have carried out an anomalous sign-in to Microsoft Office Home from an unmanaged device to expand their access to other applications like SharePoint Online and OneDrive through the Graph API and enumerate sensitive files and internal services. Another incident involved the use of a passkey lure to launch a device code phishing attack and gain control of a victim's account without having to steal their credentials or cookies, effectively getting around MFA safeguards. The third attack pattern detected by Microsoft employs compromised credentials, likely obtained from a prior event, to register their own phone-based method to bypass MFA and engage in reconnaissance and post-exploitation activity. "Following initial access, the actor's first objective was to transform a temporary compromise into a persistent foothold," the Windows maker said. "Rather than relying solely on stolen credentials, the actor enrolled an MFA method under their control, typically by registering a new phone number, authenticator application, or software-based one-time password (OTP) token." An advantage this actor-controlled second factor offers is that it allows the threat actor to sign-in into the victim's corporate account without their participation and maintain continued access in combination with unrevoked sessions or valid credentials. The various actions the threat actor can take upon establishing MFA persistence are as follows - Conduct extensive internal reconnaissance using the Graph API and inventory users, groups, permissions, resources, and accessible content across the tenant using the compromised identity. Inspect roles and high-value accounts and service identities for privilege escalation. Enumerate mailbox messages, folders, and attachment metadata for intelligence collection. Conduct high-volume access and download activity aimed at SharePoint Online and OneDrive for Business, and even Microsoft Exchange Online in some cases. Engage in sustained data exfiltration that lasts from several hours to multiple days depending on the volume of files and email content harvested from the compromised user. Deliberately rotate infrastructure across the attack lifecycle and use separate IP addresses for authentication, reconnaissance, and exfiltration activities so as to subvert network-based indicators. "The attack underscores a critical detection challenge: Microsoft Graph abuse rarely appears suspicious when viewed through a single API call," Microsoft said. "This attack serves as a strong example of why Graph activity must be assessed holistically, with emphasis on behavioral progression and cross-event correlation rather than individual API requests in isolation."

Microsoft says threat actors linked to ShinyHunters, Helix, and other extortion gangs are using passkey and single sign-on-themed social engineering attacks to compromise corporate Microsoft accounts and steal data from Microsoft 365 services. The activity has been observed since May 2026 and begins with the attackers researching targeted organizations and employees before calling or messaging victims while impersonating corporate IT help desks. The attackers tell employees that they must urgently update a passkey, multi-factor authentication (MFA), or single sign-on (SSO) configuration to avoid losing access to corporate systems. Victims are then directed to phishing sites designed to resemble legitimate Microsoft login pages, with links sometimes sent through SMS messages to employees' personal phones. Microsoft says that while the lures frequently revolve around passkeys, the attackers are not attempting to enroll a passkey. Instead, the passkey lures are used to trick targeted employees into signing in to adversary-in-the-middle (AiTM) phishing sites or using device-code authentication flows. AiTM attacks allow the threat actors to capture credentials and session tokens. Device code phishing tricks victims into authorizing access to their account via an attacker-controlled client using Microsoft's legitimate authentication pages. Microsoft says the attackers conduct extensive research before targeting employees. "The actor appears to invest heavily in pre-attack research, likely gathering information about employees and organizational structure from public sources such as social networking and professional profiling platforms," explains Microsoft. The threat actors also register phishing domains that combine company names with words related to passkeys, SSO, key synchronization, account setup, and identity verification. Some examples seen by Microsoft include: passkeyhelpdesk[.]com, secure-passkey[.]com, setupmypasskey[.]com, add-passkey[.]com, integratedsso[.]com, oktasession[.]com, keysyncos[.]com, and oskeysync[.]com. The attackers commonly place the victim company's name in a subdomain, such as company-name.secure-passkey[.]com, to make the phishing portal appear more convincing. Microsoft attributes the initial-access activity to multiple threat actors operating in the same extortion ecosystem, including groups it tracks as Storm-3121 and Storm-3032. Storm-3121 is associated with ShinyHunters and Falcon extortion, while Storm-3032 is believed to be tied to BlackFile extortion group members that now work under the Helix name. This activity overlaps with attacks previously documented by Google Threat Intelligence under the UNC6671 threat cluster. Google previously reported that UNC6671 uses phone-based social engineering and passkey-themed phishing infrastructure to compromise corporate identities before accessing enterprise cloud environments. Google has also linked UNC6671 activity to the same extortion gangs, including BlackFile, Helix, Falcon, Pink, and Redact. Mapping the Microsoft cloud after compromise Microsoft's new research gives a closer look at what happens inside Microsoft cloud environments after an account is compromised. In one investigated attack, Microsoft observed a suspicious sign-in from an unmanaged device to a Microsoft 365 service identified in Entra logs as "OfficeHome." OfficeHome is associated with the Office 365 portal's shared infrastructure, including Office applications accessed through a browser. After completing MFA, Microsoft says the attacker established a valid session and began checking what resources the compromised account could access. Within minutes, the session was used to access My Apps to see what applications are assigned to the account, My Profile for organizational information, Microsoft Approval Management, account-management interfaces, and My Sign-Ins. The attacker then accessed SharePoint Online, Outlook Web, Microsoft 365 collaboration and search services, an internal business application, and authentication flows associated with virtual desktops. Microsoft says the session remained active for approximately one hour while the attacker listed sensitive files and internal applications. In another attack, the passkey social engineering attacks led to device-code phishing, where the victim was convinced to enter a supplied code into Microsoft's legitimate authentication page. This issues an authentication token to the attacker-controlled OAuth application, allowing the threat actor to access the victim's account without completing another MFA challenge. The attacker now has access to all of the user's resources and connected SSO applications, whether they be Microsoft 365, Salesforce, Google Workspace, Dropbox, Adobe, SAP, Slack, Zendesk, Atlassian, and many others. In a third attack, the threat actor used previously compromised credentials for an account where it is believed an authenticator application had been registered days earlier. Microsoft says the threat actors then performed reconnaissance using an automated Node.js system and Microsoft Graph. After gaining access, the attackers often gain persistence by adding an MFA method they control. Microsoft says the attackers register new phone numbers, authenticator applications, and software-based one-time password tokens with compromised identities. This allows the threat actor to satisfy future MFA challenges without the victim's help, although Microsoft notes that the persistence does not survive a complete credential and session reset. The attackers then use Microsoft Graph to enumerate the victim's cloud environment. Microsoft saw Graph requests that enumerate: Organizations, licenses, and enabled services Users, groups, and group membership Directory roles and privileged accounts Registered authentication methods Applications and service principals OAuth permissions and application role assignments SharePoint sites, document libraries, folders, and files OneDrive resources Mail folders, messages, and attachments Microsoft says Graph requests such as /users, /groups, or /sites are common in enterprise environments, so they may not raise alarms. However, the activity becomes more suspicious when the same account, application, or access token rapidly moves across different resources, checks privileges and authentication settings, and then begins accessing email, attachments, files, or documents. After reconnaissance, the attackers move into cloud data collection from Microsoft 365. "Microsoft observed high-volume access and download activity targeting Microsoft SharePoint Online and Microsoft OneDrive for Business, with some intrusions extending into Microsoft Exchange Online through REST API-based access to email content," explained Microsoft. "Across SharePoint and OneDrive, the activity generated significant volumes of FileAccessed and FileDownloaded events, indicating systematic retrieval of cloud-hosted documents and organizational data." Microsoft says the activity appears automated, with connections using the python-httpx user agent during SharePoint and OneDrive access exfiltration. The attackers also appear to avoid rapid "smash-and-grab" exfiltration to avoid detection. Microsoft says the data theft instead lasts from a few hours to multiple days, with threat actors accessing fewer than 1,000 files or emails in a single hour to blend in with legitimate traffic. Microsoft recommends looking for unusual sign-ins followed by new MFA registrations, Microsoft Graph reconnaissance, and suspicious access to SharePoint, OneDrive, or Exchange. If an account is compromised, administrators should revoke active sessions and tokens, reset credentials, remove any authentication methods or mailbox rules added by the attackers, and require the user to re-register their authentication methods. Microsoft also recommends using phishing-resistant MFA, limiting sensitive cloud resources to managed devices, and disabling device-code authentication when it is not needed. Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed. Save your seat

A recent wave of cyber attacks targeting financial services, private equity, and professional services has been attributed to a data extortion group known as UNC6671. "UNC6671 continues to rely on voice phishing (vishing) to target enterprise employees, posing as IT help desk staff facilitating mandatory, urgent security migrations. Significantly, the threat actor often contacts employees via their personal mobile devices," Google Threat Intelligence Group (GTIG) and Mandiant said in a report. These calls are designed to trick victims into spoofed login portals where adversary-in-the-middle (AitM) infrastructure intercepts credentials and multi-factor authentication (MFA) tokens. The threat actors then leverage the captured data to establish session persistence and deploy automated Python and PowerShell scripts for data exfiltration from enterprise cloud environments and SaaS applications, including Microsoft 365 and Okta. According to the tech giant, UNC6671 has diversified its operations across multiple extortion brands including Redact, Pink (aka CL-CRI-1147), Helix, and Falcon (aka CL-CRI-1182). UNC6671 was previously said to have operated under the BlackFile (aka CL-CRI-1116) brand, targeting organizations via vishing and SSO compromise, before it was retired on May 11, 2026. A timeline of some of the major events is as follows - Early January 2026 - UNC6671 emerges February 6, 2026 - BlackFile Data Leak Site (DLS) launches Late April 2026 - BlackFile DLS site goes offline May 11, 2026 - BlackFile DLS site briefly comes back online to share a message that it's shutting down the brand "under this name" May 19, 2026 - Redact operators state on their new DLS site "all operations under the BlackFile name have been officially and permanently ceased" May 31, 2026 - Pink DLS site launches June 27, 2026 - Redact claims that the original BlackFile brand had been compromised and hijacked by a former associate, who allegedly carried out unsanctioned extortion campaigns under their name UNC6671 was first documented by Google in January 2026 as one of the threat clusters leveraging tradecraft traditionally associated with a financially motivated hacking group known as ShinyHunters (aka Bling Libra). Despite the similarities, it's assessed that the operations are acting independently of each other. The threat actor is known for maintaining a high operational cadence, targeting dozens of organizations in North America, Australia, and the U.K. "These compromises are not the result of a security vulnerability in vendor products or infrastructure," the company noted at the time. "Instead, this campaign continues to highlight the effectiveness of social engineering and underscores the critical importance of organizations moving toward phishing-resistant MFA to protect their SaaS and identity platforms." Cybersecurity company CrowdStrike, which is tracking the umbrella collective as Cordial Spider, characterized the group as conducting rapid data theft and extortion campaigns by impersonating IT during vishing calls and creating a false sense of urgency centered around themes related to account issues or security updates to lead victims to fraudulent AitM pages that capture their authentication data and active session tokens in real time. These credentials are then used to access the organization's identity provider (IdP), offering a "single point entry" into various SaaS applications. In tandem, the threat actors are known to establish persistence by registering adversary-controlled MFA devices to compromised accounts, but not before removing existing MFA devices. "By abusing the trust relationship between the IdP and connected services, the adversaries bypass the need to compromise individual SaaS apps and instead move laterally across the victim's entire SaaS ecosystem with a single authenticated session," CrowdStrike said. In an analysis of Pink's operations published in June 2026, SOCRadar described the group as focused on Big Game Hunting using tailored Okta and Microsoft Entra ID phishing kits, access gates to block sandboxes and researchers, and Cloudflare and DDoS-Guard for hosting and Tucows and Nicenic for domain registration. "By combining vishing-driven social engineering with gated phishing infrastructure, they have demonstrated their intent to subvert modern security measures, including MFA and passkey authentication," the cybersecurity company said. Some of the other notable tactics adopted by the threat actors include - Using credential harvesting panels hosted on generic root domains that purport to be related to passkeys, MFA, or SSO, while appending victim-specific subdomains to enable targeted voice phishing campaigns (e.g., passkeyhelpdesk[.]com, setupsso[.]com, and idokta[.]com). Some of these domains have been simultaneously used to target two entirely separate victims, each claimed by Falcon and Helix. Calling employees on their personal mobile numbers by spoofing the legitimate help desk phone number and directing them to a fake AitM phishing page. Relying on compromised email accounts to initiate password resets for non-SSO enterprise applications and systematically delete password-reset confirmations and security alerts for defense evasion. Complementing these new techniques is a shift in the threat actor's targeting footprint: from large enterprises in the manufacturing, real estate, healthcare, and insurance sectors during April and May 2026, to technology, transportation, and hospitality firms in June 2026, and then to high-value financial and legal organizations in July 2026. Google noted that UNC6671's adoption of multiple public extortion brands is likely an attempt to monetize their operations, compartmentalize negotiations, and frustrate tracking efforts. Between January 7 and May 12, 2026, Google said it tracked over $10.6 million in Bitcoin payments to wallets associated with the group. Initial ransom demands reach north of $3 million, although the extortion operators opt for reductions between 50% and 75% of the initial ransom demand during negotiations. In more than 53% of tracked cases during the time period, the threat actors are said to have settled for an average of $750,000. To counter the threat, organizations are recommended to enforce phishing-resistant MFA, integrate SaaS applications and cloud platforms with SSO, implement session controls, restrict authentication to trusted network sources, require corporate-managed devices for access, monitor IdP logs for suspicious MFA registration events, and deploy security tooling to alert if corporate password hashes are entered into unauthorized domains. The findings demonstrate how modern extortion groups operate like decentralized corporate networks, using shared infrastructure across multiple public-facing brands to manage negotiations and insulate their operations. "Regardless of whether this activity reflects a fractured threat group, outsourced extortion negotiators, or a broader affiliate network, the initial infection vector leveraged and goals of these campaigns are consistent," Google said. Over the past year, a series of vishing campaigns has exhibited overlapping tradecraft with ShinyHunters-style activity to break into Salesforce instances, establish persistent access, and exfiltrate data by taking advantage of trusted OAuth relationships and supply chain compromise through trusted workflows and integrations such as Salesloft, Gainsight, and Klue. The disclosure comes as Bridewell documented an unsuccessful vishing campaign in which threat actors made an unsolicited call to an employee's personal device and attempted to redirect them to what's believed to be a fraudulent Okta login page under the pretext of accessing an internal incident ticket. "When the employee attempted to redirect the caller to the official Service Desk, the caller refused, insisting they had been specifically routed to the employee directly, and offered an 'alternate way' to access the same ticket," security researcher Joshua Penny said. "On attempting this alternate access, the destination was blocked by existing security controls before any credential entry could occur." "The employee informed the caller he would gather more information before proceeding; the caller disconnected and made no further contact." It's believed that the attack is either the work of ShinyHunters or a threat actor operating a shared phishing-kit infrastructure consistent with Scattered LAPSUS$ Hunters (SLH) tradecraft. It's worth pointing out that Google has also raised the possibility that the different groups operating under UNC6671 could be affiliates, splinter crews, or groups using the same underlying phishing infrastructure. "The intrusion operators driving initial access and cloud data exfiltration could remain the same core group of actors, while the extortion and negotiation phases are outsourced to different actors," it added. Update In a post shared on its data leak site, Falcon has claimed it's an exclusive Redact affiliate and that it's not associated with, or connected to, UNC6671. "We share no operators, infrastructure, tooling, negotiation channels, or proceeds with any group other than Redact," it added. When reached for comment, a Google spokesperson told The Hacker News said it's aware of these claims, but said it had nothing further to share at this time. (The story was updated after publication to include the latest developments.)

UNC6671, an extortion group engaging in tailored IT helpdesk voice phishing (vishing), has rebranded and diversified its operations over the past several months, Google Threat Intelligence Group (GTIG) reports. The threat actor emerged in early 2026, operating under the ‘BlackFile’ name. In May, GTIG warned it had targeted dozens of organizations across North America, Australia, and the UK in sophisticated vishing and single sign-on (SSO) compromise attacks. Mainly focusing on Microsoft 365 and Okta infrastructure, it was leveraging adversary-in-the-middle (AiTM) techniques to bypass defenses and multi-factor authentication (MFA) and gain access to cloud environments. In May, GTIG now says, the group retired the BlackFile extortion name, but has continued its activities under multiple brands: Redact, Pink, Helix, and Falcon. The latest attacks have focused on the financial services, private equity, and professional services sectors. Posing as IT helpdesk employees, UNC6671 threat actors have been calling employees at the victim organizations, often on personal mobile phones, under the pretext of mandatory, urgent security migrations, luring them to spoofed login portals to intercept their credentials and MFA tokens. Despite different branding in extortion messages, UNC6671’s initial access and post-compromise tactics, techniques, and procedures (TTPs) have remained consistent, GTIG says. In June, the group established a new data leak site under the Redact brand, announcing the departure from BlackFile, claiming the operation had been hijacked by an affiliate. GTIG’s monitoring of UNC6671’s digital footprint showed overlaps with the operations of other extortion brands. “These overlaps support our assessment that a common group of threat actors are affiliated with the BlackFile, Redact, Pink, Helix, and Falcon extortion brands, although other scenarios such as splintered affiliates or shared Phishing-as-a-Service infrastructure may also be plausible,” GTIG says. The group has been using generic root domains across multiple victims, such as passkeyhelpdesk[.]com, portalpasskey[.]com, addssopasskey[.]com, passkeydeploy[.]com, mysecurepasskey[.]com, and passkeyuser[.]com. While some domains were exclusively used by specific extortion brands, they could be linked to UNC6671 activity through the phishing templates deployed to harvest credentials. “UNC6671’s domain registration patterns demonstrate a regular shift in target selection, seemingly towards those that are more likely to hold sensitive information. UNC6671 leverages subdomains that incorporate prospective victim names to host tailored credential harvesting panels,” GTIG notes. Recent attacks have demonstrated an evolution in tactics, with the threat actor spoofing legitimate helpdesk phone numbers and using compromised email addresses to reset the passwords for non-SSO enterprise applications, while deleting confirmation messages, alerts, and notifications to prevent detection. Between January and May, the group received over $10 million in Bitcoin across 18 wallet addresses, representing ransom payments. Some of the payments were made after the BlackFile shutdown announcement. “Initial ransom demands typically range from $1 million to upwards of $3 million USD. However, the extortion operators shifted demands during negotiations, often agreeing to reductions between 50% and 75% of the initial ransom demand. In over 53% of tracked cases in this timeframe, final payments averaged $750,000,” GTIG notes. Related: Snowflake Hacker Pleads Guilty in US Court Related: Belarusian Ransom Cartel Mastermind Gets 16 Years in Prison Related: Weaponized Email AI Assistants Could Help Attackers Hijack Accounts Related: The Fourth Battlefield: The Growing Role of Cyber Operations in Global Conflict

The BlackFile extortion group, which targets its victims through vishing scams, has rebranded. According to an analysis by Google Threat Intelligence Group (GTIG), despite BlackFile (UNC6671) having announced the retirement of its brand in 2026, it had now rebranded to Redact. Researchers said the group’s public communications cited an affiliate breakaway as the rationale for the initial rebrand. However, overlaps in phishing templates, victimology and shared infrastructure conduits suggests that associated actors have subsequently leveraged the Pink, Helix and Falcon extortion brands to monetize their operations. Redact operators published a blog post about their new data lead site (DLS) and the rebrand from Black File on June 27. The group claimed that the original BlackFile brand had been compromised and hijacked by an exiled affiliate. A rogue affiliate was apparently responsible for operating an unauthorized, lookalike DLS and conducted unsanctioned extortion campaigns under BlackFile’s name using unlinked Tox identities. They were also accused of orchestrating the supposed shutdown of the BlackFile brand in May 2026. Vishing Scams Impersonate IT Help Desks Whatever name the group operates under now, the initial access and post-compromise tactics, techniques, and procedures (TTPs) have largely remained the same, according to GTIG. GTIG said, “This most likely reflects a coordinated group of threat actors operating multiple public extortion brands possibly in an effort to compartmentalize operations, hide overall breach volumes and isolate any negotiation fallout.” The cybercriminal group uses voice phishing to target enterprise employees, posing as IT helpdesk staff facilitating mandatory, urgent security migrations. Victims are often targeted via their personal devices. The calls lure targets to spoofed login portals where Adversary-in-the-Middle (AiTM) infrastructure intercepts credentials and multi-factor authentication (MFA) tokens. Once session persistence is established, the actors deploy automated scripts for data exfiltration from enterprise cloud environments, including Microsoft 365 and Okta. GTIG was able to connect the BlackFile, Redact, Pink, Helix and Falcon extortion brands because rather than maintaining isolated infrastructure for each target, UNC6671 reuses generic root domains across multiple target organizations. Root domains like passkeyhelpdesk[.]com and passkeydeploy[.]com were used by more than one of the groups. Across all the domains identified by GTIG, the researchers noted that the same phishing templates were used. Some domains were simultaneously used to target two entirely separate victims, one of which was claimed by Falcon, and the other by Helix. “The widespread deployment of these matching templates to harvest credentials for multiple DLS brands suggests they rely on shared underlying infrastructure,” the researchers said. New Techniques and Victim Evolutions New techniques deployed by UNC6671 observed by GTIG include the use of a spoofed legitimate helpdesk phone number. The pretext of the calls is an urgent mandate to enable FIDO2 passkeys or update multi-factor authentication enrollment, the caller directs the employee to a lookalike credential-harvesting subdomain. UNC6671 has also been observed using compromised email accounts to reset passwords for enterprise applications and then delete security notifications and alert emails to evade detection and maintain persistent access. UNC6671's targeting evolved significantly between April and July 2026. From April to May, the group focused on large enterprises in the manufacturing, real estate, healthcare and insurance sectors. In June, it shifted to technology, transportation and hospitality firms, before narrowing its focus in July to high-value financial and legal organizations, including private equity firms, law firms and credit rating agencies. GTIG said between January 7 and May 12 it reviewed 18 BlackFile Bitcoin wallet addresses receiving a total of 141.65 BTC, representing approximately $10.69m USD at the time of the transactions. GTIG’s analysis of the extortion campaigns also included various recommendations for mitigation, including enforcing phishing-resistant authenticators, integrating single sign-on (SSO), enforcing session controls to reduce session length and restricting authentication to trusted network sources. Because the scam often involves vishing calls that target personal devices, GTIG said firms should ensure that authentication comes from a corporate-managed endpoint with MDM and EDR.