UNC6671 Rebrands, Runs IT Helpdesk Vishing

Google Threat Intelligence reports that extortion group UNC6671 (formerly branded “BlackFile”) is calling employees while posing as IT helpdesk staff and pushing “urgent security migrations.” Victims are lured to spoofed login pages to capture passwords and MFA tokens, enabling Microsoft 365/Okta account takeover and follow-on extortion. The group has rebranded into multiple names (Redact, Pink, Helix, Falcon) and has collected more than $10M in Bitcoin in early 2026.

Key findings

• UNC6671 uses tailored IT helpdesk phone calls to push “mandatory, urgent security migrations” and lure victims to spoofed login portals.
• The actor targets Microsoft 365 and Okta and uses adversary-in-the-middle techniques to capture credentials and MFA tokens.
• The group retired the “BlackFile” name and continues under multiple extortion brands: Redact, Pink, Helix, and Falcon.
• Generic root domains (e.g., passkeyhelpdesk[.]com) and victim-name subdomains are used to host credential-harvesting panels.
• Tactics have evolved to include spoofing legitimate helpdesk phone numbers and using compromised email accounts to reset passwords for non-SSO apps while deleting alerts.
• GTIG tracked over $10M in Bitcoin payments (Jan–May) across 18 wallet addresses; initial demands often $1M–$3M, with negotiated reductions.

Who’s being targeted

• Commonly targeted roles: All employees, Finance and treasury teams, Private equity deal teams, Professional services client teams, IT helpdesk/service desk, Cloud administrators (Microsoft 365/Okta admins).
• Affected industries: Financial services, Private equity, Professional services.
• Attack channels: vishing, website, email.
• Impersonated: Internal IT helpdesk employee, Helpdesk calling from a spoofed legitimate number.

Awareness takeaways

• Train staff to treat unsolicited ‘urgent security migration’ calls as suspicious and verify via a known internal channel before taking action.
• Teach users to never enter passwords or MFA codes into portals reached from a phone call; only sign in via known bookmarks/company app links.
• Add user education on checking domains carefully (especially ‘passkey/helpdesk/portal’ lookalikes) and reporting them quickly.
• Warn employees that caller ID can be faked; helpdesk numbers should not be treated as proof of legitimacy.

Red flags to watch for

• Unsolicited urgent migration request via phone, often to a personal mobile
• Login link goes to an unfamiliar domain (e.g., "passkeyhelpdesk[.]com") rather than the company’s normal SSO page
• Pressure to provide or approve MFA quickly while on the phone
• Caller ID matches helpdesk but the request is unexpected (caller-ID spoofing)
• Missing or disappearing security notifications/confirmation emails
• Requests to take action immediately while staying on the phone