What happened
GTIG published its campaign update on August 6, 2026 and said UNC6671 remained actively engaged in compromises leading to data-theft extortion. Attribution posture: GTIG tracks the activity as UNC6671 and assesses a common actor set links the BlackFile, Redact, Pink, Helix and Falcon brands, while acknowledging shared infrastructure or splintering as alternatives. GTIG observed the target profile narrow during July 2026 toward private-equity firms, law firms and financial rating agencies. The published infrastructure examples include passkeyhelpdesk[.]com, portalpasskey[.]com and addssopasskey[.]com. GTIG reported that seven of eight still-resolving phishing domains lacked wildcard DNS at publication.
Callers impersonate IT helpdesk staff and use urgent FIDO2 passkey or MFA-enrolment pretexts, sometimes spoofing the legitimate helpdesk number and contacting employees through personal mobile devices. Adversary-in-the-middle portals capture credentials and authentication tokens, after which automated activity accesses Microsoft 365 and Okta data. GTIG identified the Okta event names system.multifactor.factor.setup and user.authentication.auth_via_mfa for abandoned-challenge detection. GTIG advised treating FileAccessed events as high priority when UserAgent identifies python-requests, WindowsPowerShell or Go-http-client. Recent intrusions also included password resets for non-SSO applications and deletion of reset confirmations or security alerts from compromised mailboxes.
Why this matters now
The campaign targets the gap between technically strong authentication and weak enrolment or recovery processes. A user can be persuaded to visit an attacker-controlled origin before a passkey is enrolled, or an intercepted session can remain usable after the initial call. Personal-phone contact also bypasses corporate email and collaboration controls, leaving the identity platform and the user’s understanding of helpdesk procedure as the decisive controls.
The post-compromise objective is cloud data rather than endpoint encryption. That changes detection requirements: FileAccessed can represent streamed exfiltration even when FileDownloaded is absent, and deleted mailbox notifications can hide resets against applications outside central SSO. Financial, legal and transaction-heavy organisations face particular extortion leverage because individual accounts may expose deal, litigation, rating or client information.
The decision for security leaders
Move this campaign from the awareness queue into identity incident readiness. Identity owners should verify that phishing-resistant authentication applies to privileged and high-value SaaS applications, including enrolment, recovery and step-up flows. SOC teams should deploy detections for new MFA registration after failed or abandoned challenges, unmanaged-device sessions, residential-proxy authentication and scripted file access. Application owners should identify sensitive systems that still permit direct password resets outside SSO.
Treat any successful interaction with a campaign domain as a session-compromise event. Response should include session invalidation, authentication-method review, mailbox-rule and deleted-item inspection, password-reset reconciliation, SaaS audit analysis and validation of the device used after the call. Extortion escalation should depend on confirmed data access or attacker communication, not merely the appearance of an organisation-specific phishing subdomain.
Evidence of closure
- Conditional-access test results prove phishing-resistant authentication on scoped applications.
- Session inventories show invalidation of unrecognised or unmanaged-device sessions.
- SaaS audit reviews document disposition of anomalous FileAccessed events.
- Mailbox investigations reconcile deleted alerts and password-reset messages.
The Security.io assessment
The infrastructure overlap is persuasive but does not eliminate alternative operating models. GTIG explicitly allows for splintered affiliates, shared phishing services or outsourced extortion activity. That uncertainty does not change the defensive decision because the initial-access and SaaS-exfiltration techniques remain consistent across the observed brands. Defenders should hunt behaviour and session evidence rather than use a leak-site label as the primary incident classifier.
Passkeys remain an effective control when origin binding is enforced; the campaign is not evidence that passkeys are inherently defeated. The exposed path is the surrounding human and administrative process: unsolicited enrolment calls, lookalike origins, incomplete application coverage, persistent sessions and non-SSO recovery. Closure therefore requires tested authentication policy and application audit evidence, not a record that the user reset a password.
Questions for the morning meeting
- Which executives and deal teams are reachable through personal mobile numbers?
- Do passkeys protect every application holding legal, transaction or client data?
- Can the SOC distinguish scripted file access from ordinary browsing?
- Who can terminate SaaS sessions across identity and application boundaries?