Google Threat Intelligence Group (GTIG) monitors UNC6671, a cybercrime gang employing voice phishing to steal corporate data and extort victims. Although the BlackFile extortion brand reportedly ceased operations in May 2026, its activities persist under various aliases such as Redact, Pink, Helix, and Falcon. Attackers call employees via personal mobile numbers and claim urgent security updates are needed—employees must enroll FIDO2 passkeys, update MFA, or complete mandatory Microsoft 365 or Okta migrations.
Despite using distinct data leak sites and public identities, their attacks frequently employ identical phishing templates, recurring domain patterns, shared victim targeting, and overlapping infrastructure.
This does not conclusively prove that every brand is operated by a single entity, but it suggests either coordinated operations, splintered affiliates, outsourced extortion services, or shared phishing-as-a-service infrastructure. GTIG noted a surge in new phishing domain registrations in June and July, including a brief period when seven domains came online within three days, according to Google Cloud. Indicators of Compromise IOC Type Indicator Role / Notes Domain passkeyhelpdesk[.
]com Shared AI compromised phishing infrastructure linked to Falcon and Helix activity Domain addssopasskey[. ]com Falcon-related credential-harvesting panel Enhance security response times by leveraging browser-based data monitoring from ANY.RUN.
