Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
espionageThreat Actor
Active Threat
UNC6671
58
IOCs Tracked
3
Intel Reports
Associated IOCs50 total
Domain47
passkeydeploy.com2026-10-09High
deploypasskey.com2026-10-09High
passkeyadd.com2026-10-09High
passkeyhelpdesk.com2026-10-09High
portalsetuphub.com2026-10-09High
oskeyconnect.com2026-10-09High
passkeyportalsetup.com2026-10-09High
mspasskey.com2026-10-09High
addmypasskey.com2026-10-09High
activatepasskey.com2026-10-09High
activatemypasskey.com2026-10-09High
passkeycreator.com2026-10-09High
newpasskey.com2026-10-09High
mypasskeyid.com2026-10-09High
oktaportalsso.com2026-10-09High
passkeyuser.com2026-10-09High
passkeyrollout.com2026-10-09High
hubpasskey.com2026-10-09High
keyokta.com2026-10-09High
enablepasskey2fa.com2026-10-09High
passkeycreate.com2026-10-09High
addoktapasskey.com2026-10-09High
mynewpasskey.com2026-10-09High
registerpasskey.com2026-10-09High
passkey-check.com2026-10-09High
createmypasskey.com2026-10-09High
addyourpasskey.com2026-10-09High
checkpasskey.com2026-10-09High
passkeycenter.com2026-10-09High
passkeysupport.com2026-10-09High
enrollpasskey.com2026-10-09High
mypasskeysso.com2026-10-09High
myoktasso.com2026-10-09High
startpasskey.com2026-10-09High
portalpasskey.com2026-10-09High
addssopasskey.com2026-10-09High
createssopasskey.com2026-10-09High
add-passkey.com2026-10-09High
enablepasskey.com2026-10-09High
assignpasskey.com2026-10-09High
mysecurepasskey.com2026-10-09High
setupsso.com2026-10-09High
idokta.com2026-10-09High
setpasskey.com2026-10-09High
createmfa.com2026-10-09Medium
passkey-enable.com2026-10-09Medium
passkeystatus.com2026-10-09Medium
CVE3
CVE-2026-645312026-10-26Medium
CVE-2026-630772026-10-09Medium
CVE-2026-704262026-08-14Medium
Related Reports3 total
UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments
Google Threat Intelligence (GTIG / Mandiant)Aug 6, 2026
Weekly Cybersecurity Newsletter — Top 50 Cybersecurity Stories of the Week (August 3–7, 2026)
Cyber PressAug 9, 2026
UNC6671 Vishing Gang Hijacks Microsoft 365 and Okta Accounts to Extort Financial Firms
Cyber PressAug 7, 2026
Threat Profile
Motivationespionage
Last seenOct 2026
IOCs tracked58