UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

What it is

UNC6671 is a vishing and data-theft extortion cluster tracked by Google Threat Intelligence Group (GTIG). GTIG assesses that BlackFile (announced as retired in May 2026), Redact, Pink, Helix and Falcon are probably brands of one coordinated group. The brands share phishing infrastructure and templates, and the tradecraft has not changed between them.

How it works

Callers phone employees on their personal mobiles, posing as IT helpdesk. In at least some recent cases they spoof the real helpdesk number. The pretext is an urgent mandate to enable FIDO2 passkeys or update MFA enrollment. Victims are sent to a per-company subdomain such as [company].createssopasskey[.]com or [company].addssopasskey[.]com. An AiTM panel there captures credentials and MFA tokens. Scripts then pull data from Microsoft 365 and Okta.

Newer evasion: operators use compromised mailboxes to trigger password resets on non-SSO apps. They then delete the reset confirmations, security notifications, company-wide alerts and any alerts from MFA or account changes.

The linking evidence is that generic root domains (for example passkeyhelpdesk[.]com) serve identical templates to victims later claimed by different brands. Seven of eight still-resolving phishing domains had no wildcard DNS, so passive-DNS hits on a subdomain suggest that company was specifically targeted.

Targeting and tempo

• April to May 2026: 28 root domains, one every 2.2 days, aimed at large enterprises in manufacturing, real estate, healthcare and insurance.
• June 2026: technology, transportation and hospitality firms.
• July 2026: private equity, law firms and rating agencies. Provisioning ran at about one domain every 1.6 days, with seven domains in the 72 hours of 20 to 22 July.

Money

GTIG reviewed 18 BlackFile wallets that received 141.65 BTC (about $10.69 million) between 7 January and 12 May 2026. Payments continued after the 11 May shutdown notice. Initial demands run from $1 million to over $3 million. Operators accept cuts of 50% to 75%. In over 53% of tracked cases the final payment averaged about $750,000 (~10.2 BTC).

What to do

• Enforce phishing-resistant MFA (FIDO2 keys, passkeys, Windows Hello for Business, Okta FastPass). Origin binding defeats lookalike domains and AiTM proxies.
• Put SaaS apps behind Entra ID or Okta SSO. This removes the non-SSO reset path used for persistence.
• Shorten sessions (re-authenticate at least daily), add idle timeouts and step-up for sensitive resources, and use token-theft mitigations (IP session binding, Device-Bound Session Credentials, Continuous Access Evaluation).
• Restrict authentication to known network zones and require managed devices (MDM and EDR) in Entra ID or Okta policy.
• Enable Google Workspace Password Alert, or Defender SmartScreen and Credential Protection for Microsoft 365.
• Hunt in Okta and Entra logs for system.multifactor.factor.setup events immediately preceded by user.authentication.auth_via_mfa failures or abandoned push challenges.
• Treat FileAccessed in the Microsoft 365 unified audit log (UAL) as seriously as FileDownloaded when the user agent is python-requests, WindowsPowerShell or Go-http-client, or when volume exceeds human norms. Listed user agents include python-requests/2.28.1 and WindowsPowerShell/5.1.
• Alert on SSO logins from commercial VPNs (Mullvad, Private Layer) or residential broadband proxy pools that depart from the user's geographic baseline.
• Google SecOps rules in the Okta and Microsoft 365 packs include "Okta Suspicious Actions from Anonymized IP", "O365 SharePoint Bulk File Access or Download via PowerShell" and "O365 SharePoint High Volume File Access Events".

Caveats

• GTIG's single-group view is an assessment. Splintered affiliates, shared commodity AiTM panels and vishing services, or outsourced extortion could also explain the overlaps.
• The IOCs sit in a GTI Collection that needs registration. Domains are often used within minutes of registration and most IPs are commercial VPN nodes, so GTIG says they show naming patterns and are not suited to real-time blocking. Phishing domains were added to Google Safe Browsing.
• Personal-phone calls fall outside corporate telephony controls, so the page offers no technical control for that step beyond the authentication hardening above.