A real campaign of voice-phishing (vishing) calls targeted major hedge funds and private equity firms by impersonating internal IT/help desk staff. Victims were pressured into completing “routine” security steps and were sent to fake login pages that captured usernames, passwords, and MFA codes in real time, enabling attackers to access Microsoft 365/Okta data and later attempt extortion.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get a call on your personal cell: “Hi, this is the help desk, we need you to enroll your FIDO2 passkey right now.” Sounds routine, right? They rush you: “Open our company authentication site and sign in so we can finish the update.” You type your Microsoft 365 login, approve MFA, and an adversary-in-the-middle page quietly grabs everything. Behind the scenes, they register their own MFA device, then walk through Microsoft 365, Okta, SharePoint, OneDrive, even apps like Salesforce or Zendesk, auto-scripting massive data downloads before trying extortion. Here’s the move: if a “help desk” call asks you to log in or approve MFA, hang up and call the real help desk using the number on your intranet, never from the number that just called you.
A criminal group tracked as UNC6671 called employees while pretending to be their company IT helpdesk, creating urgency around “mandatory” security changes. Victims were directed to lookalike login pages to “enable passkeys” or “update MFA,” allowing attackers to steal passwords and capture…
A phone-first extortion campaign targeted dozens of major U.S. financial firms by calling employees and posing as corporate help-desk staff. Victims were pushed to “update” passkeys/MFA and sent to fake login pages; attackers captured passwords and MFA codes in real time to take over accounts and…
A ransom-focused hacking group targeted major U.S. financial and other firms by calling employees on their personal phones while impersonating the company help desk. Victims were pushed to “update passkeys or multifactor authentication” and sent to look‑alike websites designed to steal passwords…
Levi Strauss reported that an unauthorized party used social-engineering to compromise three employees’ company-issued computers and steal corporate data. Reporting tied the incident to a wider campaign where attackers impersonated IT help desks using spoofed phone numbers and fraudulent websites…
Google says the BlackFile extortion group (UNC6671) rebranded to “Redact” while keeping the same core scam: phone calls that impersonate IT helpdesk staff and push “urgent security migrations.” Victims are directed to spoofed login pages that steal passwords and MFA codes, enabling attackers to…
The roundup describes real social-engineering incidents: a phishing email that led an employee to enter credentials on a fake Microsoft 365 login page, and a wave of voice-phishing attempts against major hedge funds using voice-mimicking technology. Both incidents show practical lures that can be…
