UNC6671 Automates Microsoft 365 Data Theft After Hijacking Employee Sessions

UNC6671 is carrying out data theft campaigns that begin with a phone call. The group poses as an IT helpdesk, claiming an urgent security migration is necessary. A convincing call and a fake sign-in page can turn an ordinary session into an entry point.

The calls create urgency before employees can verify the request independently. The campaign is dangerous because it does not need to crack a password.

It captures credentials and a live authentication token. That token lets an intruder act as the employee in Microsoft 365 or Okta, to access mail, files and other stored corporate data.

Analysts at Google Cloud identified the activity during ongoing data theft and extortion.

Google Cloud said in a report shared with Cyber Security News (CSN) that the group has stayed active despite the claimed retirement of its BlackFile brand, using Redact, Pink, Helix and Falcon names.

The consequences extend beyond a hijacked inbox. Stolen records can expose sensitive information and fuel extortion.

Recent targeting shifted toward financial services, private equity and professional services, where deal and litigation material can be especially valuable.

UNC6671 Automates Microsoft 365 Data Theft

The operation starts with voice phishing, often called vishing. Callers contact staff on personal mobile phones, sometimes spoofing a helpdesk number, claiming a passkey or multi-factor authentication update is mandatory.

They direct employees to tailored imitation enrolment portals, a technique also seen in Microsoft Graph reconnaissance attacks against workplace accounts.

The fraudulent site sits between the victim and the real login service. This adversary-in-the-middle setup relays the sign-in process while collecting the password and multi-factor authentication token.

UNC6671 can then reuse the authenticated session, an approach similar to the session hijacking payroll attacks against Microsoft 365 users.

Once inside, operators use automated scripts to take data from cloud services. The report notes direct-stream access patterns associated with scripting tools, enabling large-scale reading without conventional downloads.

The group also uses residential proxy connections to make access look closer to ordinary user traffic and complicate incident response.

The operators have added steps to stay hidden. They used compromised mailboxes to reset passwords for applications that do not use single sign-on, then deleted reset confirmations, security notices and alerts tied to account or multi-factor authentication changes. That can leave a victim unaware while access and data collection continue.

Shared Infrastructure Raises Extortion Risk

Google Cloud linked the activity through recurring phishing templates, overlapping victim targeting and reused domain infrastructure.

The same generic passkey-themed domains supported campaigns used by several extortion brands, although researchers said this could reflect a coordinated group, splintered affiliates or shared phishing services.

Brand changes should not distract defenders from the method behind them.

The pace also increased. From June through July, researchers observed about one new root domain every 1.6 days, with seven domains activated over a 72-hour period in late July.

Names frequently combine passkey, MFA or SSO, reinforcing the false impression that a routine security task is underway.

Defenders should make it easy for employees to verify unexpected helpdesk requests through a known company channel.

Security teams should enforce phishing-resistant sign-in methods, shorten session lifetimes, require stronger checks for sensitive resources and restrict authentication to managed devices and trusted networks.

These measures reduce the value of a stolen session. This matters because AiTM phishing campaigns targeting Microsoft 365 aim to exploit a valid session, not merely a stolen password.

Teams should review identity-provider and Microsoft 365 audit data for abandoned authentication challenges, unusual multi-factor enrolment, high-volume file access and scripting-related user-agent strings.

Treating FileAccessed events with the same urgency as downloads can expose direct-stream collection.

Monitoring for anonymised or residential-proxy logins adds another warning when activity is unusual or comes from an unfamiliar device.

UNC6671 shows how a phone call can breach cloud security. Organisations that combine staff verification procedures with resistant authentication, session controls and behavioural monitoring can stop theft before stolen data becomes an extortion tool.

Indicators of Compromise (IoCs):-

tionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world