Passkey-themed phishing attacks lead to Microsoft 365 data theft
Microsoft links ShinyHunters- and Helix-affiliated actors to passkey-themed vishing and device-code phishing that compromises Microsoft 365 accounts and steals cloud data.
78
- Mentions · 7d0
- Mentions · 30d0
- All mentions4
- First seenAug 17, 2026
- Last mentionedSep 11, 2026
Timeline
4 articles · newest firstAttackers call employees’ personal phones to break into Microsoft 365 accounts
Microsoft tracks vishing campaigns by Storm-3121 and Storm-3032 that impersonate IT staff, phish Microsoft 365 credentials, and steal cloud data.
74
UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data
Google and Mandiant attribute vishing-based SaaS data extortion attacks to UNC6671, now operating under the Redact, Pink, Helix, and Falcon brands.
78
Details emerge on BlackFile's recent attacks on financial companies
BlackFile (UNC6671), a The Com-linked extortion crew, keeps hitting financial and med tech firms with voice-phishing IT-support scams and ~$3 million demands.
70
Appears with
- BlackFilethreat actor · 4
- Helixthreat actor · 4
- ShinyHuntersthreat actor · 3
- Microsoftvendor · 3
- UNC6671threat actor · 3
- Microsoft 365product · 3
- Mandiantvendor · 2
- Google Threat Intelligence Grouporganization · 2
- Googlevendor · 2
- Storm-3121threat actor · 2
- Redactthreat actor · 2
- Storm-3032threat actor · 2
- Microsoft Graphproduct · 2
- Mandiantorganization · 2
- Pinkthreat actor · 2
- Salesforceproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.