Google: New UNC6783 hackers steal corporate Zendesk support tickets

Google Threat Intelligence Group reports that UNC6783 targets BPOs to steal corporate Zendesk support tickets and other sensitive data via social engineering, phishing, spoofed Okta login pages (domains like <org>.zendesk-support<##>.com), and clipboard-stealing phishing kits that can bypass MFA; the actor has also distributed fake security updates to deliver RATs and subsequently extorts victims, with claims of large breaches (e.g., an alleged Adobe data theft). Mandiant recommends FIDO2 keys, live-chat monitoring, blocking spoofed domains, and auditing MFA enrollments.