Organization

Google Threat Intelligence

1 mentions in 7 days · 2 in 30 days · 2 total · first seen Aug 18, 2026 · last 5d ago

Timeline2 articles

Passkey-themed phishing attacks lead to Microsoft 365 data theft

Microsoft links ShinyHunters- and Helix-affiliated actors to passkey-themed vishing and device-code phishing that compromises Microsoft 365 accounts and steals cloud data.

Microsoft attributes passkey- and SSO-themed social engineering activity, observed since May 2026, to Storm-3121 (linked to ShinyHunters and Falcon) and Storm-3032 (tied to BlackFile members now operating as Helix). Attackers impersonate corporate IT help desks by phone or SMS, urging fake passkey, MFA, or SSO updates and directing victims to adversary-in-the-middle phishing pages or device-code authentication flows that yield credentials, session tokens, and OAuth tokens. Post-compromise behavior includes Microsoft Graph enumeration of users, SharePoint, and OAuth grants, plus persistence via attacker-controlled MFA methods. Google Threat Intelligence tracks related activity as UNC6671, linked to the BlackFile, Helix, Falcon, Pink, and Redact extortion gangs.

BleepingComputerupdated Sep 16, 14:54 UTC · 11h agofirst Sep 11, 17:26 UTC · 5d agoPhishing & fraud in the wild 9 sources2

Staying Ahead of Adversarial AI Through Agentic Source Code Review

Google Threat Intelligence details an agentic AI pipeline with human expert oversight to review source code and outpace AI-enabled attackers.

Google Threat Intelligence researchers argue that adversaries' misuse of AI raises the risk of data theft and extortion when proprietary source code is exposed. They describe a structured agentic source code review pipeline that combines AI models with skeptical validation steps and injected human domain expertise. The team reports a leap in efficacy in finding vulnerabilities before adversaries can exploit them.

Google Threat IntelligenceAug 18, 14:00 UTC · 29d agoResearch1

Appears with

threat actor BlackFile 1 threat actor Falcon 1 threat actor Helix 1 threat actor ShinyHunters 1 threat actor Storm-3032 1 threat actor Storm-3121 1 threat actor UNC6671 1 product Dropbox 1 product Google Workspace 1 product Microsoft 365 1 product Microsoft Graph 1 product Outlook Web 1 product Salesforce 1 product SharePoint Online 1 product Slack 1 vendor Google 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.