Redact Rebrand Uses IT Helpdesk Vishing

Google says the BlackFile extortion group (UNC6671) rebranded to “Redact” while keeping the same core scam: phone calls that impersonate IT helpdesk staff and push “urgent security migrations.” Victims are directed to spoofed login pages that steal passwords and MFA codes, enabling attackers to access cloud accounts like Microsoft 365 and Okta and then exfiltrate data for extortion.

Key findings

• BlackFile (UNC6671) reportedly rebranded to “Redact,” while related branding also included Pink, Helix, and Falcon.
• The group’s main initial-access method is vishing that impersonates IT helpdesk staff and pressures users into urgent security changes.
• Victims are sent to spoofed login portals using Adversary-in-the-Middle (AiTM) infrastructure to capture credentials and MFA tokens.
• GTIG linked multiple brands due to reused infrastructure and phishing templates, including root domains passkeyhelpdesk[.]com and passkeydeploy[.]com.
• Newly observed tactics include spoofing a legitimate helpdesk phone number and using compromised email accounts to reset passwords and delete security alerts.

Who’s being targeted

• Commonly targeted roles: All employees, Executives, Finance, Legal, IT helpdesk/service desk, Identity and access management (IAM) teams.
• Affected industries: Manufacturing, Real estate, Healthcare, Insurance, Technology, Transportation, Hospitality, Financial services, Legal services, Private equity, Credit rating agencies.
• Attack channels: vishing, website.
• Impersonated: IT helpdesk staff (internal help desk), Legitimate helpdesk (spoofed phone number).

Awareness takeaways

• Treat unexpected ‘IT helpdesk’ security migration calls as suspicious, verify using an official internal directory or ticketing system before doing anything.
• Never sign in from a link/domain provided during a phone call; navigate to known corporate URLs instead.
• Be extra cautious when calls or authentication prompts involve personal devices, attackers deliberately target them.
• If you suspect account compromise, report immediately, attackers may delete security notifications to hide their activity.

Red flags to watch for

• Unsolicited urgent call pressuring immediate security changes
• Employee is directed to a lookalike/spoofed login portal
• Call targets a personal device rather than corporate channels
• Caller ID shows a familiar helpdesk number but the request is unusual/urgent
• Pushes the user to act immediately rather than follow normal IT change process
• Requests actions on personal devices