Fake IT help-desk calls are stealing Microsoft 365 and Okta data

A data-extortion crew has renamed itself five times in a year, and that is the part your detection stack should worry about. Google's analysts track the operation as UNC6671. Its members phone employees on personal mobiles, pose as the company help desk, and talk their way into Microsoft 365 and Okta. That chain has not changed since early 2025. What keeps changing is the name on the leak site, and every rename quietly ages out the indicator list you built for the last one.

The group started as BlackFile, announced a shutdown in May 2026, then reappeared as Redact, with Pink, Helix, and Falcon running in parallel. Google Threat Intelligence Group (GTIG) assesses that one core team sits behind all of them, splitting the work across brands to blur how much it has stolen. A party linked to the Falcon brand has publicly disputed being part of the same group, so treat the single-operator conclusion as GTIG's assessment rather than settled fact. Either way, the tradecraft is identical under every name, and the tradecraft is what a defender can key on.

The call that skips every control you paid for

The way in is a phone call, not an email or a bug. GTIG reports that UNC6671 operators phone staff while impersonating IT help desk agents running an urgent security migration, usually a demand to enroll a passkey or change multi-factor authentication (MFA) settings. They frequently spoof the real help desk number, and they reach people on personal phones.

Reaching the personal phone is the move that matters. A call to a personal handset never touches corporate call recording, mobile device management, the email gateway, or data-loss tooling. Almost everything most teams spend on sits on the wrong side of that call. The victim is then steered to a lookalike sign-in page, such as a subdomain of createssopasskey or addssopasskey, where an adversary-in-the-middle (AitM) proxy relays the login in real time and grabs the password, the MFA token, and the session cookie together.

With a live session cookie, the attacker is inside without needing the password again. GTIG says the operators then run automated scripts to pull data out of cloud tenants, naming Microsoft 365, Okta, and Salesforce, and delete the password-reset and security alerts that would warn the user. The requests carry tells a human browser never sends, such as a python-requests or WindowsPowerShell user agent.

Why five brand names is a detection problem

Read the rebrands as an anti-detection tactic pointed at you, not as gossip about the criminal underground. The day BlackFile becomes Falcon, an indicator list titled BlackFile stops matching, a threat feed splits one actor into five, and the question "have we seen this group?" returns a false no. Attribution by brand is a step behind by design, because the brand is the one variable the crew rewrites at will.

The money says why they bother. GTIG tracked roughly $10.69 million in crypto payments across 18 wallets between January and May 2026, with demands in the low millions settling near $750,000 after negotiation, and counted 71 phishing domains stood up between April and August at an accelerating pace. Spreading that volume across brands hides the true size of the operation from victims deciding whether to pay and from anyone trying to measure it.

The defensive takeaway is to stop tracking the brand and start tracking the chain. A vishing call to a personal phone, a passkey or MFA migration pretext, an AitM proxy, then a scripted read from a SaaS tenant: that sequence is constant under every name, and it is what your detections should match.

The same front door we keep writing up

This is less a new kind of attack than the current run of one we have covered before. Scattered Spider has been winning through the help desk rather than a CVE for years. The EY breach came in through IT support. The Klue campaign pulled Salesforce data through a trusted connected app, no exploit required. The shared thread: the way in is a human process, and the theft looks like a normal authenticated session rather than malware.

That is why endpoint and email tooling keep missing it. There is no attachment to detonate and no binary to flag. A stolen session cookie survives a password reset, the same reason a reset does not evict a session thief. The signal lives in the identity provider and the SaaS audit log, not on the laptop.

The hunt that survives the next rename

Because the chain is constant, detections built on it keep working after the brand changes. Three are worth standing up now, each drawn from behavior GTIG documented:

• A fresh MFA enrollment right after failed logins. In Okta or Microsoft Entra ID audit logs, an MFA registration that lands immediately after authentication failures or an abandoned push is the AitM handoff. Alert on that ordering, not on either event alone.

• Reads that behave like downloads. Most teams alert on a file download, not a file access. Scripted exfil pulls data through read events with a scripting user agent such as python-requests, which slips past download-only rules. Give a file-access event carrying a scripting agent, or volume beyond human browsing, the same weight as a bulk download.

• Sign-ins from proxy and odd network space. Logins from commercial VPNs or residential proxy pools that break an employee's normal geography are a strong anomaly. Feed them into conditional access as a block or a step-up prompt.

As with the login-focused approach we described for encryptionless extortion, the useful signal is at the identity layer, where a legitimate-looking session is the only trace the attacker leaves.

Origin binding is the one control that ends the call

GTIG lists nine mitigations, and one of them removes the attack instead of raising its cost. Phishing-resistant MFA built on WebAuthn, meaning FIDO2 security keys or platform passkeys, ties each credential to the exact domain that issued it. The spoofed number still rings, the personal phone still answers, the AitM proxy still relays, and the login still fails, because the lookalike domain cannot satisfy the cryptographic origin check. That is the single point in the chain where credential theft stops outright.

The other controls are all worth doing, and none of them closes the hole alone. Shorter sessions and step-up prompts shrink the window a stolen cookie is useful. Requiring a managed device for sensitive access narrows who can log in. Binding a session to a device or an IP raises the cost of replaying a cookie. Stack them, but buy the origin-binding control first, because it is the one the attacker cannot route around. If you cannot deploy it everywhere at once, start with the accounts that reach finance, legal, and executive data, which is where this crew is aiming now.

None of this needs a new signature the next time they rename. If your team is hunting these logins and wants a second set of eyes on the identity signals, that is the work our managed threat hunting desk does. Watch the call and the session, not the brand on the leak site.