The extortion group UNC6671 is conducting a large-scale voice phishing (vishing) campaign against financial, legal and technology organizations in North America, Australia and the United Kingdom. According to Google Threat Intelligence Group and Mandiant, the attackers call employees on their personal mobile phones, pose as technical support, and redirect victims to fake login portals where adversary-in-the-middle (AitM) infrastructure intercepts credentials and multi-factor authentication (MFA) tokens. The hijacked sessions are used to steal data from Microsoft 365, Okta and other enterprise cloud services. Between January and May 2026, Google tracked more than $10.6 million in Bitcoin payments associated with this group.
Attack chain: from phone call to exfiltration
The attack starts with a phone call to an employee’s personal mobile device. The attackers spoof the caller ID so it displays the legitimate number of the corporate support desk, and create a sense of urgency by claiming there is a “mandatory security migration” or a problem with the user’s account. The victim is then directed to a phishing page that mimics the corporate login portal.
A key element of the infrastructure is credential collection panels hosted on generic-sounding domains themed around authentication. Google has observed the following domains being used:
passkeyhelpdesk[.]comsetupsso[.]comidokta[.]com
A unique subdomain is created for each victim, enabling targeted campaigns. Notably, some of these domains were simultaneously used to attack two different organizations, with each attack claimed under different group “brands” — Falcon and Helix.
After intercepting credentials and MFA tokens via the AitM infrastructure, the attackers gain access to the organization’s identity provider (IdP). This gives them a single entry point into the entire ecosystem of SaaS applications connected via single sign-on (SSO). The attackers then:
- Register their own MFA devices on the compromised accounts, first removing the legitimate ones
- Deploy automated Python and PowerShell scripts for bulk data exfiltration from cloud environments
- Use compromised mailboxes to reset passwords for applications without SSO, systematically deleting reset notifications and security alerts
As Google emphasizes, these compromises are not related to vulnerabilities in vendor products or infrastructure — the attack is built entirely on social engineering and abuse of the trust relationship between the IdP and connected services.
Multiple brands, one group
A distinctive trait of UNC6671 is the use of several public extortion “brands.” According to Google, the group has operated under the names Redact, Pink (CL-CRI-1147), Helix and Falcon (CL-CRI-1182 under Unit 42’s classification). Previously, the group is believed to have acted under the BlackFile brand (CL-CRI-1116), which was officially shut down on May 11, 2026.
The brand rotation timeline looks as follows: BlackFile appeared in February 2026, went offline at the end of April, and on May 19 the Redact operators announced a complete end to operations under that name. On May 31, the Pink leak site went live. According to Google analysts, this rotation is intended to maximize monetization of operations, separate negotiation processes and make tracking more difficult.
Google first documented UNC6671 in January 2026, noting similarities in tactics with the ShinyHunters (Bling Libra) group, but assessed that these clusters operate independently of one another. Analysts consider it possible that the initial access and data exfiltration operators are the same group, while the extortion and negotiation phases are outsourced to other actors.
Evolution of targets and monetization scale
According to Google, in April–May 2026 UNC6671 attacked organizations in the manufacturing, real estate, healthcare and insurance sectors. In June the focus shifted to technology, transportation and hospitality companies, and in July to high-revenue financial and legal organizations. This evolution indicates a deliberate move toward victims with maximum ability to pay.
The financial figures confirm the model’s effectiveness: initial ransom demands exceed $3 million, although during negotiations the operators agree to reductions of 50–75%. In more than 53% of tracked cases, the final amount averaged $750,000.
Research by SOCRadar, published in June 2026, showed that the Pink brand uses specialized phishing kits for Okta and Microsoft Entra ID, employs sandbox and researcher blocking mechanisms, and relies on Cloudflare and DDoS-Guard for hosting.
Practical example: a foiled attack
Bridewell documented an unsuccessful vishing attempt in which an attacker called an employee’s personal device and tried to redirect them to a fake Okta login page under the pretext of accessing an internal incident ticket. When the employee suggested contacting the official support team, the caller refused and offered an “alternative way” to gain access. Existing security controls blocked navigation to the malicious resource before any credentials were entered, after which the attacker broke off contact.
Defense recommendations
Google recommends the following set of measures to counter UNC6671’s tactics:
- Deploy phishing-resistant MFA (FIDO2 hardware security keys) — this is the primary measure that neutralizes token interception via AitM
- Integrate all SaaS applications and cloud platforms with a single SSO provider
- Implement session controls with limited lifetimes and binding to trusted network sources
- Require the use of corporately managed devices for accessing resources
- Monitor IdP logs for suspicious MFA device registration events — especially deletion of existing devices and addition of new ones
- Deploy tools that alert when corporate password hashes are entered on unauthorized domains
- Provide employee training on recognizing vishing, emphasizing calls demanding urgent action around “security migration”
The UNC6671 campaign demonstrates that even without software vulnerabilities, attackers can compromise an organization’s entire cloud ecosystem through a single successful vishing call. The top priority for organizations using Okta, Microsoft Entra ID or similar IdPs is an immediate transition to phishing-resistant FIDO2-based MFA and an audit of current MFA enrollment policies in the identity provider.
