Hackers Impersonate IT Support to Breach Leading Financial Companies

Hackers tied to UNC6671 (aliases Redact, Pink, Helix, Falcon) executed a large vishing-and-credential-harvesting campaign targeting employees at more than 200 organizations—notably financial firms and law firms—by impersonating IT support, directing victims to lookalike subdomains to capture MFA/passkey credentials, then using automated tools to access cloud services (Microsoft 365, Okta), steal data, and extort victims for million-dollar ransoms; Google telemetry and tracked Bitcoin payments indicate ongoing, active operations.