UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data
Summary: Google Threat Intelligence Group and Mandiant attributed a vishing campaign to the data extortion group UNC6671, which calls employees on personal mobile devices while posing as IT help desk staff running urgent security migrations and directs them to adversary-in-the-middle portals that capture credentials and MFA tokens. The stolen sessions are used to reach identity providers such as Okta and Microsoft 365, where the actors remove existing MFA devices, register their own, and run Python and PowerShell scripts to exfiltrate data. Google tracked over $10.6 million in Bitcoin payments to wallets associated with the group between January 7 and May 12, 2026, with initial demands above $3 million and more than 53% of tracked cases settling at an average of $750,000.
What you should know: The entry point is a phone call to a personal number, not a software flaw, and a single captured identity provider session lets an attacker move across the entire SaaS estate without compromising individual apps. With more than half of tracked negotiations settling near $750,000, the group's economics depend on victims who have not yet moved to phishing-resistant MFA.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026