Google Threat Intelligence Group (GTIG) recently highlighted ongoing activity from a financially motivated threat actor tracked as UNC6783, linked to a persona known as “Raccoon,” that continues to target high value enterprises across multiple sectors. The actor’s primary strategy focuses on compromising business process outsourcing (BPO) providers that support these organizations, though direct targeting of internal helpdesk and support teams has also been observed. Attacks rely heavily on social engineering and commonly abuse live chat interactions to redirect employees to spoofed Okta login pages hosted on domains impersonating the victim organization using legitimate Zendesk infrastructure, often following an <org>[.]zendesk-support<##>[.]com pattern. A sophisticated phishing kit allows the attacker to steal clipboard data, bypass standard MFA, and enroll their own devices for persistent access. In parallel, fake security updates have been used to deploy remote access malware. Following data exfiltration, victims are contacted via Proton Mail with extortion demands. GTIG’s findings align with recent, unconfirmed breach claims by “Mr. Raccoon,” including alleged compromises involving Adobe and other firms through India based BPOs and the theft of large volumes of support and employee data. CTIX Analysts recommend that organizations strengthen phishing resistant MFA, monitor live chat abuse, block spoofed Zendesk-style domains, and audit MFA device enrollments as this threat continues to evolve.