'Several dozen' high-value corporations hit by new extortion crew in helpdesk phishing spree

UNC6783 is a financially motivated extortion crew targeting dozens of high-value corporations by compromising BPOs and helpdesk staff through social engineering and phishing (including spoofed Okta pages). The group uses a custom phishing kit to bypass MFA, steals credentials and data, deploys remote-access malware, and sends ransom notes via ProtonMail; an alleged Adobe breach claims large-scale data theft of support tickets and employee records.