Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
5 IOCs
UNC6671 Vishing Gang Hijacks Microsoft 365 and Okta Accounts to Extort Financial Firms
Threat Actors
Excerpt
Google Threat Intelligence Group (GTIG) is tracking UNC6671, a cybercrime group using voice phishing attacks to steal corporate data and extort victims. Although the BlackFile extortion brand reportedly shut down in May 2026, the group’s operations appear to have continued under several new names, including Redact, Pink, Helix, and Falcon. The group targets enterprise workers by posing as internal IT helpdesk staff. Attackers call employees, often on personal mobile numbers,…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(5)
Capability
Victim
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | portalpasskey.com | High | Score 67/100 | First seen |
| Domain | addssopasskey.com | High | Score 67/100 | First seen |
| Domain | passkeyhelpdesk.com | High | Score 72/100 | First seen |
| Domain | createssopasskey.com | High | Score 67/100 | First seen |
| Domain | passkeydeploy.com | High | Score 87/100 | First seen |
IOC Relationship Graph
Building graph…