UNC6671 VishUNC6671 is a data extortion group that relies on tailored IT helpdesk voice phishing (vishing) to compromise organizations’ cloud environments, primarily Microsoft 365 and Okta. Emerging in early 2026 under the BlackFile brand, it has since rebranded into multiple extortion labels (Redact, Pink, Helix, and Falcon) while keeping the same core tactics. Posing as internal IT staff and calling employees on their personal phones, UNC6671 claims urgent security or SSO migrations and directs victims to spoofed login portals. There, adversary in the middle (AitM) infrastructure captures credentials and MFA tokens, which are then used to access identity providers, register attacker-controlled MFA devices, and exfiltrate data from SaaS apps using automated Python and PowerShell scripts. The group uses generic “passkey” and SSO-themed domains (passkeyhelpdesk[.]com, setupsso[.]com) with victim-specific subdomains, and has extracted over $10 million in Bitcoin, with typical final ransom payments around $750,000. CTIX Analysts suggest that defenses emphasize phishing-resistant MFA, tight identity provider (IdP) and SSO controls, monitoring for suspicious MFA changes, restricting access to corporate-managed devices, and training staff to distrust unsolicited “IT” calls directing them to new login pages.ing Attacks Target Personal Phones to Steal SaaS Data