A ransom-focused hacking group targeted major U.S. financial and other firms by calling employees on their personal phones while impersonating the company help desk. Victims were pushed to “update passkeys or multifactor authentication” and sent to look‑alike websites designed to steal passwords and capture one-time MFA codes live on the phone.
Attackers called employees directly on their personal cellphones while posing as the company's internal IT help desk. In some cases, the caller ID displayed the correct help desk phone number, adding a layer of false legitimacy to the call. The pretext was simple: an urgent directive from IT required the employee to update their passkeys or multifactor authentication immediately.
Once the employee was on the phone, they were steered toward a booby-trapped website with domain names designed to look official, such as those resembling 'passkeyhelpdesk' or 'secure-passkey.' If the employee entered their password on that site, the attackers captured it immediately. Because the attacker was still on the line, they could then ask the victim to read back or approve the one-time passcode sent by text or generated by an authenticator app, harvesting it live and hijacking the account before the call ended.
This attack did not rely on advanced malware or technical exploits. It relied on urgency, a plausible authority figure, and a live phone conversation that gave the attacker real-time control over the victim's actions. Reaching employees on personal phones bypassed corporate call filtering and security awareness cues that might apply to work lines. The spoofed help desk number reinforced trust at the exact moment the victim was asked to act quickly.
The technique also exploited a structural weakness in one-time passcodes: they are only secure if entered on a legitimate site and never shared verbally. By combining a credential-harvesting site with a live phone call, attackers closed that gap and defeated MFA in real time.
Organizations across the affected sectors, including private equity, hedge funds, financial services, and law firms, can reduce exposure by reinforcing a few core behaviors. Employees should be trained to treat unsolicited help desk calls to personal numbers as high risk and to hang up and call back using a number from a trusted internal directory rather than one provided by the caller.
Staff should also be reminded that legitimate IT teams do not ask employees to read out or approve MFA codes during an inbound call, and that any password or MFA update should happen through official self-service portals the employee navigates to independently. As one security researcher observed regarding this activity, the tactics were not technically sophisticated but were highly effective, underscoring that awareness training must focus on identity verification and resisting real-time pressure rather than solely on spotting technical red flags.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
They called employees on their personal cellphones, sometimes spoofing the correct help desk phone number, and claimed there was an urgent directive to update passkeys or multifactor authentication.
After directing victims to a look-alike website to enter their password, the attackers harvested the one-time passcode live over the phone and hijacked the account before the call ended.
The campaign affected private equity firms, hedge funds, financial services companies, law firms, and financial ratings agencies, among others.
Hang up and call back using a trusted number from the internal directory, and never enter a password or read out an MFA code during an inbound call.
You’re at home, personal cellphone rings: caller ID says “Company IT Help Desk.” They sound legit, and urgent. They say, “There’s an urgent directive from IT to update your passkeys and MFA.” Then they walk you to a site like passkeyhelpdesk-dot-com and ask you to log in while they wait. Here’s the trap: the moment you type your password, they grab it, and then say, “Read me the one-time code you just got.” They hijack your account before you hang up. If “IT” calls your personal phone about passkeys or MFA, hang up and call the help desk back using the number in our internal directory, never the one that just called you.
A criminal group tracked as UNC6671 called employees while pretending to be their company IT helpdesk, creating urgency around “mandatory” security changes. Victims were directed to lookalike login pages to “enable passkeys” or “update MFA,” allowing attackers to steal passwords and capture…
A phone-first extortion campaign targeted dozens of major U.S. financial firms by calling employees and posing as corporate help-desk staff. Victims were pushed to “update” passkeys/MFA and sent to fake login pages; attackers captured passwords and MFA codes in real time to take over accounts and…
A real campaign of voice-phishing (vishing) calls targeted major hedge funds and private equity firms by impersonating internal IT/help desk staff. Victims were pressured into completing “routine” security steps and were sent to fake login pages that captured usernames, passwords, and MFA codes in…
Levi Strauss reported that an unauthorized party used social-engineering to compromise three employees’ company-issued computers and steal corporate data. Reporting tied the incident to a wider campaign where attackers impersonated IT help desks using spoofed phone numbers and fraudulent websites…
Apollo Global Management disclosed a breach after attackers used social engineering to access some of its cloud platforms over several days in July. The company says personal data may have been exposed, including names, contact details, and Social Security numbers. Reporting links the incident to…
Apollo Global Management disclosed a data breach after attackers used social engineering to gain unauthorized access to certain cloud platforms over several days in July. The attackers obtained sensitive personal data (including Social Security numbers), highlighting how stolen credentials and…
