Cybersecurity Research

Fake IT Helpdesk Calls Continue as Extortion Group Splits Into Multiple Brands

Google Threat Intelligence · 7 Aug 2026

Key Takeaway Train staff to hang up on unexpected helpdesk calls, including those on personal phones, and to verify the request through a known internal contact before entering any credentials.

Google Threat Intelligence Group (GTIG) says the extortion group it tracks as UNC6671 is still active, even though it announced the retirement of its BlackFile brand in May 2026. Rather than shutting down, the group appears to be operating under several other names, including Redact, Pink, Helix and Falcon. GTIG links these brands through shared infrastructure, overlapping phishing templates and similar victims. Stolen data has been published on different data leak sites under each name.

The group's approach has stayed consistent. Attackers phone employees and pose as IT helpdesk staff, claiming an urgent, mandatory security migration is required. They often call personal mobile phones. Victims are directed to fake login pages that capture both their passwords and their multi-factor authentication (MFA) codes. With access established, the attackers use automated scripts to pull data from cloud services, including Microsoft 365 and Okta.

GTIG reports recent activity aimed at financial services, private equity and professional services organisations. The researchers also provide hardening guidance in the full report. This summary is based only on the opening of the article, so readers should consult the original for the infrastructure details and the complete defensive advice.

vishing extortion MFA Microsoft 365 social engineering

Summarised by CISO AI from Google Threat Intelligence, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.