Microsoft has tracked passkey- and SSO-themed help desk impersonation since May 2026, with the calls steering employees into adversary-in-the-middle proxies and device-code grants that hand over live Microsoft 365 sessions.
Perspective Coverage
3 publishers
- Builder
- Builder 25%
- Operator
- Operator 63%
- Investor
- Investor 12%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+10
- Incentives35
- Confidence70
BlackFile wears four extortion brands, so your threat feed is counting one actor as several
Google says UNC6671 split its extortion into Redact, Pink, Helix and Falcon on shared infrastructure while still working finance, legal and med tech. It averages 1.5 new victims a day.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+20
- Incentives45
- Confidence55
The firm says intruders reached its cloud platforms in July and took names, birth dates and Social Security numbers. Google attributes the campaign to BlackFile, a Com affiliate with four extortion brands.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence58
Both banks Everest named in April traced the breach to a third-party vendor
Intel 471's 18-month sweep of the underground counted 340 financial-sector extortion victims across 74 countries, 159 firms with access for sale and 562 claimed DDoS attacks. The dated intrusions came in through vendors and help-desk calls.
Reality
- Evidence40
- Adoption55
- Hype gap+22
- Incentives78
- Confidence47
The extortion call now comes from your help desk, and the fix is a procedure you own
Google says the BlackFile crew has targeted dozens of organisations by phoning staff and posing as internal IT. No vendor bug is involved, which puts the remedy on IT leadership.
Reality
- Evidence70
- Adoption42
- Hype gap+8
- Incentives62
- Confidence58
UNC6671 did not retire: four brands, one helpdesk script, and calls to personal phones
Google Threat Intelligence Group says the crew behind BlackFile spread into Redact, Pink, Helix and Falcon while keeping the same vishing route into Microsoft 365 and Okta.
Reality
- Evidence60
- Adoption45
- Hype gap+8
- Incentives62
- Confidence55