New Data Extortion Group “Pink” Goes Big Game Hunting With Evasive Phishing Kits

Pink is a Com‑affiliated data extortion group conducting Big Game Hunting via vishing and highly evasive, operator‑controlled phishing kits tailored to Microsoft Entra ID and Okta. The group uses multi-stage gating (fingerprinting, human-interaction checks), backend heartbeat/approval to filter targets, dynamic branding, MFA/passkey subversion workflows, and Beacon API exfiltration; targets are primarily US healthcare, technology, and financial organizations, and the campaign is active since at least March 2026.