The Vishing Gang That Stole $10M Just Rebranded: How to Spot the Fake IT Helpdesk Call

What is the UNC6671 vishing scam and why did Google flag it now?

UNC6671 is a financially motivated extortion group that uses voice phishing (vishing), a scam in which attackers call targets by phone rather than sending a malicious email or link, to steal corporate cloud credentials and then extort the victim organization. Google Threat Intelligence Group (GTIG) tracks UNC6671 as an active extortion group that emerged in early 2026 under the BlackFile name, conducting tailored IT helpdesk vishing and single sign-on (SSO) compromise attacks. The reason GTIG published its updated findings on August 6, 2026, is that the group did not stop operating when BlackFile announced a shutdown in May. GTIG confirmed that UNC6671 remained active after BlackFile’s announced retirement and had diversified its operations across multiple extortion fronts, including Redact, Pink, Helix, and Falcon.

The rebrand itself was constructed to appear legitimate. On June 27, 2026, operators behind Redact publicly claimed the original BlackFile brand had been compromised by an exiled affiliate. The operators asserted that a rogue affiliate had orchestrated the BlackFile shutdown to damage the brand’s reputation, and stated they were rebranding as Redact with a new verified contact identity to authenticate future correspondence. GTIG’s infrastructure analysis contradicted the narrative: GTIG based the linkage on shared phishing infrastructure, overlapping victimology, and identical credential-harvesting templates.

How does the fake IT helpdesk call actually work?

UNC6671 targets enterprise employees by posing as IT helpdesk staff facilitating mandatory, urgent security migrations, and the threat actor often contacts employees via their personal mobile devices. This is a deliberate tactic: a call to a personal number bypasses corporate call-monitoring systems and reaches the employee directly without triggering any corporate security alert. The caller may tell the employee they must enroll a FIDO2 passkey, update multi-factor authentication, or complete a mandatory Microsoft 365 or Okta migration, and the victim is then directed to fraudulent login pages hosted on domains that imitate passkey, MFA, single sign-on, and helpdesk services.

The fraudulent site sits between the victim and the real login service, and this adversary-in-the-middle setup relays the sign-in process while collecting the password and multi-factor authentication token. This is the critical mechanism that makes the attack effective against MFA-protected accounts: the victim’s legitimate credentials and live MFA code are captured and replayed to the real service simultaneously, so the attacker receives a fully authenticated session. Once authenticated, automated scripts are used to access and exfiltrate data from Microsoft 365 and Okta environments. The entire sequence, from the initial call to a fully authorized cloud session, requires no software vulnerability and no malware installation on the victim’s device. Because the attack exploits only human trust, employees who believe they are completing a routine IT task can inadvertently hand over access to every cloud application linked to their SSO account.

The group registered generic root domains that hosted credential-harvesting pages and created subdomains that included victim names to make login pages appear legitimate. Observed domain names from GTIG’s reporting include patterns such as passkeyhelpdesk[.]com, portalpasskey[.]com, and mysecurepasskey[.]com. The inclusion of the victim’s company name as a subdomain is intended to make the URL look credible in the browser bar, particularly on a small mobile screen where the full domain is rarely visible.

Who has UNC6671 targeted, and what data does it steal?

UNC6671’s targeting evolved significantly between April and July 2026. From April to May, the group focused on large enterprises in the manufacturing, real estate, healthcare, and insurance sectors. In June 2026, the group shifted to the technology, transportation, and hospitality sectors, focusing on stealing intellectual property, source code, and sensitive client data. The group then narrowed its focus in July to high-value financial and legal organizations, including private equity firms, law firms, and credit rating agencies. This sector-by-sector rotation reflects the group’s deliberate effort to maximize extortion leverage by targeting the most sensitive data available in each vertical.

The shift to financial and legal targets in July carries particular risk because of the nature of the data involved. Mergers and acquisitions files, capital deployment records, fund valuations, and portfolio company data command far higher extortion leverage than retail customer records. Reuters and Bloomberg reported that Point72 Asset Management, Millennium Management, Two Sigma Investments, Citadel, and several private-equity firms were targeted in recent attacks that relied on vishing to trick employees into granting attackers access to corporate systems. According to prior large-scale data theft extortion cases, organizations that pay ransoms do not always receive meaningful assurance that stolen data has been deleted.

How much money has UNC6671 collected, and how does the extortion model work?

Between January 7, 2026, and May 12, 2026, GTIG reviewed 18 BlackFile Bitcoin wallet addresses receiving a total of 141.65 BTC, representing approximately $10.69 million USD at the time of the transactions. Cryptocurrency researcher ZachXBT assisted GTIG with the blockchain investigation. Payments continued even after the group announced the shutdown of its leak site, showing that operations remained active during the rebranding phase. This detail matters because it confirms the announced shutdown was a deliberate misdirection rather than a genuine cessation of activity.

Google noted that UNC6671’s adoption of multiple public extortion brands is likely an attempt to monetize operations, compartmentalize negotiations, and frustrate tracking efforts. Running four simultaneous brand identities means each negotiation is isolated. A victim dealing with Falcon, for example, may have no reason to connect their incident to a prior BlackFile case, which limits their ability to assess the group’s history of following through on deletion promises or to coordinate with other victims on negotiation strategy. The practical implication for security teams is that brand name alone is no longer a reliable indicator of threat actor identity. Behaviors, infrastructure patterns, and the specific attack sequence are more reliable signals than the name on the extortion demand.

Why does this vishing attack defeat standard MFA protections?

Standard multi-factor authentication protects accounts against password theft by requiring a second factor, such as a one-time code from an authenticator app or a push notification approval, before granting access. UNC6671’s adversary-in-the-middle technique defeats this protection because the victim voluntarily enters both factors on the spoofed portal, believing they are completing a legitimate IT enrollment. The fraudulent site sits between the victim and the real login service, and the adversary-in-the-middle setup relays the sign-in process while collecting the password and the MFA token simultaneously. The attacker then replays those captured credentials to the legitimate service in real time, before the short-lived MFA token expires.

This matters because many organizations rely on MFA as their primary post-password security layer. The UNC6671 technique renders SMS one-time passwords, push-based approvals, and time-based one-time passwords equally ineffective, since all three require the user to input or approve something that the AiTM proxy can capture and forward. After stealing Microsoft 365 or Okta single sign-on accounts, the attackers log into the SSO dashboard, which gives access to all the cloud platforms linked to the account. The breadth of access gained through a single SSO compromise is why this attack class produces high extortion leverage quickly. Organizations concerned about related risks to their AI coding and development tools should also be aware of how AI agent access controls can be exploited through similar trust-based manipulation.

How do you recognize a fake IT helpdesk vishing call?

Recognizing a UNC6671-style vishing call requires attention to 4 specific patterns that distinguish attacker calls from legitimate IT contact. They are unsolicited urgency, personal phone contact, a login request sent during the call, and a URL that does not match the organization’s known domain.

1. The call arrives on your personal mobile number without prior notice. UNC6671 callers contact targeted employees on their personal mobile numbers, circumventing corporate security controls. A legitimate internal IT helpdesk will typically contact employees through verified corporate communication channels first.
2. The caller claims a mandatory, urgent security action is required immediately. Victims are told they need to complete an urgent security migration or account update. Urgency is a deliberate pressure tactic designed to prevent the employee from pausing to verify the request independently.
3. The caller asks you to log in to a URL they provide. The caller may say the employee must enroll a FIDO2 passkey, update MFA, or complete a mandatory Microsoft 365 or Okta migration, and the victim is directed to fraudulent login pages on domains imitating passkey, MFA, SSO, and helpdesk services. Any login page sent to you by the caller rather than initiated by you through a known bookmark or official portal is a warning sign.
4. The domain name contains passkey, helpdesk, SSO, or your company name as a subdomain of an unfamiliar root domain. The group registered generic root domains that hosted credential-harvesting pages and created subdomains that included victim names to make login pages appear legitimate. Always check the full root domain, not just the subdomain, before entering credentials.

In at least some recent cases, the threat actor has spoofed the legitimate helpdesk phone number, adding an appearance of legitimacy. This means caller ID alone cannot be trusted as verification. The correct response to any unsolicited IT call is to end the conversation politely, locate the IT helpdesk number in your organization’s official internal directory, and call back on that number to confirm whether the request is genuine. Do not use a number the original caller provides. If you are an employee at a financial or legal organization, report the attempted call to your security operations team immediately, as UNC6671 has been conducting active campaigns against those sectors as of July 2026. For broader guidance on how social engineering intersects with emerging AI tool risks, your security team should be reviewing access policies across all cloud-connected platforms.

What should organizations do to reduce exposure to this attack?

Organizations can reduce their exposure to UNC6671-style vishing attacks through a combination of employee training, technical controls, and verification procedures. No single control eliminates the risk entirely, because the attack exploits human trust rather than a software vulnerability, but the combination of the steps below significantly increases the effort required for the attacker to succeed.

1. Train employees to treat any unsolicited IT call as unverified until a callback to the organization’s official helpdesk confirms the request. This applies even when the caller ID appears correct, since GTIG confirmed the group spoofs legitimate helpdesk numbers.
2. Deploy phishing-resistant MFA, such as FIDO2 hardware security keys. FIDO2 keys are cryptographically bound to the legitimate origin domain and will not authenticate a spoofed portal, which is the one MFA method that AiTM proxies cannot readily bypass. Standard TOTP codes, SMS codes, and push approvals remain vulnerable to AiTM interception.
3. Monitor for new authentication events from unusual locations or devices in Microsoft 365 and Okta audit logs. Automated scripts are used to access and exfiltrate data from Microsoft 365 and Okta environments immediately after session establishment, so rapid detection of an unexpected new authenticated session is one of the few intervention windows available.
4. Block or alert on authentication requests originating from known AiTM proxy IP ranges. GTIG and Gurucul have published indicators of compromise, including phishing domains and associated IP addresses, that security teams can add to their detection rules.
5. Establish a formal callback verification policy for all helpdesk-initiated requests that involve credential enrollment, MFA changes, or passkey setup, and communicate that policy explicitly to all employees so that any deviation from the policy is itself a red flag.

Organizations that have experienced a compromise should engage an incident response firm before taking containment actions, because the attackers establish session persistence through automated scripts and may retain access through multiple sessions that a single password reset will not fully revoke. Contact your cyber insurance carrier and legal counsel before communicating externally about any confirmed data exfiltration, since the data involved may trigger notification obligations under state privacy laws or federal sector-specific regulations. This is not legal advice; the specifics depend on your jurisdiction, the nature of the data, and the applicable statute.

Employees who work in sectors UNC6671 has targeted, including financial services, private equity, legal, manufacturing, healthcare, and technology, should also review whether their personal mobile numbers are accessible through public sources such as LinkedIn, since digital footprint exposure contributes meaningfully to how attackers identify and reach individual targets.

FAQ

What is vishing and how is it different from phishing?

Vishing is voice phishing: attackers place a phone call to manipulate the target rather than sending a malicious email or link. The UNC6671 group uses vishing specifically because a phone call creates real-time pressure and bypasses many of the email security filters and link-scanning tools organizations deploy. Standard phishing protection, such as email filtering, does not block a vishing attack.

Can MFA stop the UNC6671 attack?

Standard MFA does not stop this specific attack. UNC6671 often contacts employees via their personal mobile devices, and these calls lure victims to spoofed login portals where adversary-in-the-middle infrastructure intercepts credentials and MFA tokens simultaneously. FIDO2 hardware security keys are the exception, because they authenticate only to the legitimate domain and cannot be relayed by a proxy portal.

Is the BlackFile extortion group actually shut down?

BlackFile as a brand is retired, but the underlying UNC6671 operation is actively running under four new names. In its August 6, 2026 report, GTIG assessed that UNC6671 remained active after BlackFile’s apparent retirement in May and had diversified extortion activity under the Redact, Pink, Helix, and Falcon names. Ransom payments to BlackFile-linked wallets continued even after the shutdown announcement, confirming the group never stopped operating.

What industries are currently at highest risk from UNC6671?

Financial services and legal organizations are the current primary targets as of July 2026. According to Mandiant’s report, the group’s targeting switched in July 2026 toward private-equity firms, hedge funds, major law firms, and financial-rating agencies, after previously targeting organizations in the manufacturing, healthcare, real estate, technology, transportation, and hospitality sectors. The group has demonstrated a consistent pattern of rotating sectors, so organizations outside finance should not consider themselves lower-priority targets over the longer term.

What should I do if I think I received one of these fake IT calls?

Do not log in to any URL the caller provided, and report the call to your security team immediately. If you did enter credentials on a URL provided during an unsolicited call, notify your IT security team right away so they can audit your Microsoft 365 and Okta session logs, revoke active sessions, and reset credentials before automated exfiltration scripts can complete their work. Do not attempt to investigate or remediate the compromise on your own; contact your organization’s security operations team or an incident response provider.