Hackers Are Calling Your Employees to Steal Microsoft 365 Access — Here's How It Works

Also on CyberFence: compare CyberFence to other VPNs side-by-side · the free CyberFence security tools .

Your employees know not to click suspicious email links. They use multi-factor authentication. They've been through security awareness training. But a new wave of attacks is bypassing all of that — by simply calling them on the phone.

Google's Threat Intelligence Group (GTIG) disclosed this week that a financially motivated cybercrime group called UNC6671 has collected more than $10 million in ransom payments since January 2026 by calling employees, impersonating IT helpdesk staff, and walking them through a process that hands over their Microsoft 365 and Okta credentials — including the MFA tokens the accounts require.

The group, which operated under the BlackFile extortion brand before rebranding to Redact, Pink, Helix, and Falcon after a dispute with affiliates, has targeted financial services companies, private equity firms, and professional services organizations across North America, Australia, and the United Kingdom. Average ransom payments were $750,000. Some initial demands exceeded $3 million.

How the Attack Works: A Phone Call That Bypasses MFA

UNC6671's attack is called a vishing attack — voice phishing — and the execution is more sophisticated than the name implies.

Here's the step-by-step of how UNC6671 takes over a Microsoft 365 account:

1. The call: An attacker calls an employee on their personal mobile phone — not their desk phone. The caller ID is spoofed to show the victim's own organization's IT helpdesk number. The caller sounds professional, mentions specific company details they've gathered from LinkedIn or prior reconnaissance, and explains that a mandatory, urgent security migration is underway.
2. The urgency: The attacker tells the employee their account has been flagged for a required security update, or that they need to re-authenticate their Microsoft 365 passkey configuration. Missing the step, they're told, could lock them out of the company's systems.
3. The portal: The employee is directed to a spoofed login page hosted on a domain crafted to look legitimate — GTIG documented specific domains including passkeyhelpdesk.com, portalpasskey.com, mysecurepasskey.com, and others with company-specific subdomains that include the victim organization's name.
4. The MFA bypass: When the employee enters their credentials, the attacker relays them to Microsoft's real login page in real time — an adversary-in-the-middle (AiTM) technique. Microsoft sends the real MFA prompt to the employee's authenticator app. The employee approves it thinking it's the legitimate helpdesk process. The attacker captures the resulting session token.
5. Silent access: With the session token, the attacker has full authenticated access to the Microsoft 365 account — email, OneDrive, SharePoint, Teams. They delete confirmation emails, change alerts, and remove notifications to prevent detection while they exfiltrate data and establish persistence.

The MFA step is what makes this attack particularly effective: the employee genuinely completes a real authentication prompt. From Microsoft's perspective, the login was fully authenticated. From the attacker's perspective, they now have an active, legitimate session.

Why This Attack Works When Others Don't

Most phishing defenses are built around email. Spam filters, link scanners, sandboxing, and user training all target email-delivered threats. UNC6671 sidesteps this entirely by using voice — an attack channel that most organizations don't monitor, filter, or train for with the same rigor.

Phone-based social engineering exploits psychological dynamics that email can't replicate: real-time conversation, time pressure, authority impersonation, and the social awkwardness of questioning someone who sounds like an internal IT colleague. Employees who would immediately delete a suspicious email may comply with a phone call from what appears to be their own helpdesk, especially when the caller demonstrates specific knowledge of internal systems and uses correct company terminology.

The AiTM MFA bypass is the technical layer that makes this attacks more dangerous than traditional credential phishing. Standard TOTP-based MFA (Google Authenticator, Microsoft Authenticator code prompts) doesn't protect against AiTM attacks — the codes are captured and relayed before they expire. An employee who follows correct MFA practice — only approving prompts they initiated — can still be victimized if they're deceived into thinking the helpdesk call triggered the authentication request.

$10 Million in Five Months: The Financial Scale

GTIG tracked more than 18 bitcoin wallet addresses associated with UNC6671 activity between January and May 2026, receiving payments totaling more than $10 million. That figure covers only the wallets GTIG was able to attribute — the actual total is likely higher.

The ransom negotiation pattern is documented:

• Initial demands: $1 million to over $3 million
• Negotiated reductions: 50% to 75% from the initial ask
• Final payments in 53%+ of tracked cases: approximately $750,000

For context: $750,000 average payment from a campaign that requires no malware deployment, no ransomware, and no technical vulnerability — just phone calls, spoofed portals, and AiTM credential theft. The group's success is a direct reflection of how underdefended voice-based attack channels are relative to email.

The Rebrand Trail: BlackFile → Redact → Pink → Helix → Falcon

UNC6671 is notable for its use of multiple extortion brands. GTIG assessed that a common group of threat actors operated across BlackFile, Redact, Pink, Helix, and Falcon — changing brand names after disputes with affiliates, law enforcement attention, or strategic resets while keeping the same initial-access tactics, techniques, and procedures throughout.

The rebranding pattern is significant for defenders: threat intelligence tied to "BlackFile" may not surface when the same group operates under "Falcon." Attribution-based defenses — block lists tied to specific brand names — don't work against groups that cycle identities while maintaining consistent operational methods. Behavioral defenses (blocking the specific phishing domains, detecting AiTM patterns, monitoring for unusual M365 session characteristics) are more durable.

Who Is at Risk

UNC6671 has focused on organizations that hold valuable data and are likely to pay to recover it:

• Financial services firms — wealth managers, RIAs, broker-dealers, private credit funds
• Private equity firms — deal-sensitive communications, portfolio company data
• Professional services — law firms, accounting firms, consulting practices

The common thread: organizations where M365 email access means access to confidential client data, deal communications, and sensitive financial information — and where that data's exposure creates leverage for extortion demands.

Smaller professional firms are particularly at risk because they're less likely to have security operations teams monitoring for unusual M365 session activity, and their employees may have fewer internal resources to consult when something feels suspicious about a helpdesk call.

What Actually Stops This Attack

Standard security controls are largely ineffective against UNC6671's approach. Specific defenses that do work:

Phishing-resistant MFA (FIDO2/passkeys): Hardware security keys and device-bound passkeys that authenticate to a specific origin domain cannot be relayed by an AiTM proxy. If the login portal isn't microsoft.com, the passkey simply won't authenticate. This is the single most effective technical control against AiTM attacks. TOTP-based MFA (authenticator app codes) does not provide this protection.

DNS-layer phishing domain blocking: UNC6671 uses specific registered domains to host their AiTM credential-harvesting portals. CyberFence's Web Shield blocks known malicious domains at the DNS layer — before the browser loads the page. If an employee is directed to passkeyhelpdesk.com or a similar domain, the DNS query is intercepted and the connection is blocked. The credential harvest never starts, regardless of whether the employee was deceived by the phone call.

Employee training on vishing specifically: Organizations that train employees to verify IT helpdesk callers through a separate, known-good channel (calling back the helpdesk directly, opening an IT support ticket, messaging a colleague) reduce vishing success rates significantly. The key behavior: never follow a link or portal provided by an inbound caller, regardless of how legitimate they sound.

Conditional access policies: Microsoft Entra ID (formerly Azure AD) conditional access policies can restrict M365 login to known, compliant devices — preventing session tokens captured on attacker infrastructure from being used from unknown devices or locations.

Session anomaly monitoring: Unusual M365 session characteristics — login from an unfamiliar IP, simultaneous sessions from different geographic locations, large email exports shortly after login — can be detected and alerted on through Microsoft Sentinel or third-party SIEM platforms.

The Practical Response for Small and Mid-Size Organizations

Large financial institutions have security operations centers and dedicated threat intelligence. Smaller firms — the independent RIAs, boutique PE firms, and professional services practices that UNC6671 specifically targets — need actionable steps they can implement immediately:

• ✅ Enable phishing-resistant MFA on all M365 and Okta accounts — hardware keys or passkeys, not TOTP codes
• ✅ Install CyberFence on all employee devices — Web Shield blocks AiTM phishing domains before employees can interact with them
• ✅ Brief all staff on vishing — the specific scenario: "Someone calls claiming to be IT and asks you to log in to a website. Never do this without verifying through a separate channel."
• ✅ Establish a verification protocol for IT helpdesk calls — employees should always call back the helpdesk through a known number, never follow links from inbound callers
• ✅ Review M365 conditional access policies — restrict login to compliant, registered devices where possible
• ✅ Enable M365 session anomaly alerts — get notified of unusual login patterns, large export activities, or unfamiliar device logins

UNC6671 is not a sophisticated nation-state actor deploying zero-day exploits. It's a criminal group making phone calls and hosting spoofed login pages. The $10 million it collected since January reflects a security gap that's entirely closable with the right combination of phishing-resistant authentication, DNS-level domain blocking, and employee awareness of voice-based attacks.

Want to go deeper? Read the CyberFence competitor comparison hub , our free privacy and security tools , or CyberFence plans and pricing .