Passkey-themed phishing attacks lead to Microsoft 365 data theft
Microsoft links ShinyHunters- and Helix-affiliated actors to passkey-themed vishing and device-code phishing that compromises Microsoft 365 accounts and steals cloud data.
78
Threat actor
BlackFile
- Mentions · 7d0
- Mentions · 30d0
- All mentions7
- First seenAug 13, 2026
- Last mentionedSep 11, 2026
Timeline
7 articles · newest firstAttackers call employees’ personal phones to break into Microsoft 365 accounts
Microsoft tracks vishing campaigns by Storm-3121 and Storm-3032 that impersonate IT staff, phish Microsoft 365 credentials, and steal cloud data.
74
Hackers Pose as IT Support to Hijack Microsoft 365 Accounts With Fake Passkey Alerts
Microsoft warns of vishing campaigns by Storm-3121 and Storm-3032 hijacking Microsoft 365 accounts via fake passkey alerts, adding attacker-controlled MFA and exfiltrating cloud data.
72
UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data
Google and Mandiant attribute vishing-based SaaS data extortion attacks to UNC6671, now operating under the Redact, Pink, Helix, and Falcon brands.
78
Apollo discloses data breach from ongoing wave of attacks hitting financial sector
Apollo Global Management confirmed a breach of cloud platforms by BlackFile-linked social engineering attackers, exposing personal data including Social Security numbers.
82
Details emerge on BlackFile's recent attacks on financial companies
BlackFile (UNC6671), a The Com-linked extortion crew, keeps hitting financial and med tech firms with voice-phishing IT-support scams and ~$3 million demands.
70
Srsly Risky Biz: Data Theft Extortion Is Booming! Hooray!
Google's Threat Intelligence Group reports data theft extortion is surging, with Silent Ransom extracting $10M and $18M from two law firms and BlackFile taking $10M.
75
Appears with
- Helixthreat actor · 5
- Microsoft 365product · 4
- Falconthreat actor · 4
- Microsoftvendor · 4
- ShinyHuntersthreat actor · 4
- Storm-3032threat actor · 3
- Redactthreat actor · 3
- UNC6671threat actor · 3
- SharePointproduct · 3
- Google Threat Intelligence Grouporganization · 3
- Storm-3121threat actor · 3
- OneDriveproduct · 3
- Googlevendor · 3
- Exchange Onlineproduct · 2
- Microsoft Graphproduct · 2
- Mandiantorganization · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.