A phone-first extortion campaign targeted dozens of major U.S. financial firms by calling employees and posing as corporate help-desk staff. Victims were pushed to “update” passkeys/MFA and sent to fake login pages; attackers captured passwords and MFA codes in real time to take over accounts and later extort victims.
This campaign relied on a phone call rather than an email to start the intrusion. Attackers called employees directly on their personal phones, posing as corporate help-desk staff. In some cases the calls even displayed the legitimate help-desk number, which added a layer of false credibility before the pretext was even delivered.
Once on the line, the caller claimed there was an urgent request to update a passkey or multifactor authentication setting. Employees were directed to fake login pages using domain names such as "passkeyhelpdesk" and "secure-passkey." These pages were built to look like legitimate corporate authentication portals.
The technique worked because it combined three pressures at once: a spoofed or legitimate-looking caller ID, a plausible IT pretext tied to security hygiene (updating MFA), and urgency delivered live over the phone. Because the request came through a voice call instead of an email or text, many of the usual phishing red flags, like a suspicious sender address or hover-over link preview, were not present.
Once a victim entered a password on the fake page, the attackers captured the authentication code sent by text message or generated by an authenticator app while the call was still underway. This let them complete account takeover in real time, without waiting for a delayed credential dump or code reuse.
Defending against this kind of attack means training employees to treat unexpected phone calls with the same scrutiny as phishing emails. Staff should independently verify any IT request through a known, trusted channel rather than relying on caller ID, urgency, or instructions given during the call itself.
Organizations should also reinforce that MFA codes are a security control, not information to be shared verbally, and that employees should navigate to official portals themselves rather than following links given during an unsolicited call. Because account takeover in this campaign was tied to potential extortion, teams should have a clear, fast path for reporting suspected help-desk impersonation so security teams can respond before access is misused.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers called employees on personal phones posing as corporate IT help-desk staff, claiming an urgent need to update a passkey or MFA setting, then directed victims to fake login pages that captured passwords and MFA codes in real time.
In some cases the calls displayed the legitimate help-desk number, so caller ID alone could not confirm the call was genuine.
Employees should independently verify the request through a known, trusted channel rather than relying on caller ID, urgency, or instructions given during the call, and should never read out or confirm an MFA code over the phone.
According to the reporting, account takeover was used to access sensitive corporate information and provide leverage for extortion.
Imagine this: your personal phone rings, caller ID says Corporate Helpdesk, and they say your passkey update is urgent. They say, “We need you to update your passkey or MFA right now. Go to passkeyhelpdesk-dot-com and log in while I’m on the line.” You type your password, then read back the MFA code that just hit your phone. Here’s the trap: while you’re talking, they capture your password and that one-time code and log in as you, same trick used against Wall Street, Uber, Zillow, Levi’s, and big law firms in a five-week blitz. If anyone on the phone ever asks you to log in using their link or share an MFA code, hang up and call the real helpdesk using the number on our intranet, never the one that just called you.
A criminal group tracked as UNC6671 called employees while pretending to be their company IT helpdesk, creating urgency around “mandatory” security changes. Victims were directed to lookalike login pages to “enable passkeys” or “update MFA,” allowing attackers to steal passwords and capture…
A ransom-focused hacking group targeted major U.S. financial and other firms by calling employees on their personal phones while impersonating the company help desk. Victims were pushed to “update passkeys or multifactor authentication” and sent to look‑alike websites designed to steal passwords…
Google says the BlackFile extortion group (UNC6671) rebranded to “Redact” while keeping the same core scam: phone calls that impersonate IT helpdesk staff and push “urgent security migrations.” Victims are directed to spoofed login pages that steal passwords and MFA codes, enabling attackers to…
The roundup describes real social-engineering incidents: a phishing email that led an employee to enter credentials on a fake Microsoft 365 login page, and a wave of voice-phishing attempts against major hedge funds using voice-mimicking technology. Both incidents show practical lures that can be…
The article describes real-world ways attackers get around multifactor authentication (MFA), including “push bombing” (MFA fatigue), phishing pages that relay codes in real time, SIM swapping, and stealing session cookies so MFA isn’t needed again. It also cites known incidents (e.g., Uber 2022 MFA…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
