Threat reportPhishingTL-2026-4667
Ongoing Help Desk Voice Phishing (Vishing) Campaign with AitM MFA Relay Targeting Canadian Organizations (AL26-028) - UNC6671 / BlackFile
Ongoing Help Desk Voice Phishing (Vishing) Campaign with (TL-2026-4667), also tracked as AL26-028, is a high-severity phishing campaign, first published 2026-10-28. It is attributed to UNC6671 with medium confidence, affects Microsoft Microsoft 365 / Entra ID / SharePoint / OneDrive, maps to 16 MITRE ATT&CK techniques (T1059.001, T1059.006, T1078.004), and is covered by 9 detection rules and 15 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 16MITRE ATT&CK
- Actors
- 2UNC6671
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 15Indicators of compromise
Key facts for TL-2026-4667
- Threat ID
- TL-2026-4667
- Also known as
- AL26-028, AV26-028, Help Desk Vishing Campaign, BlackFile Vishing Extortion Operation
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution
- UNC6671, BlackFile
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- legal, financial services, private equity, professional services, technology, hospitality
- Target regions
- canada, North America, united kingdom, australia
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in Ongoing Help Desk Voice Phishing (Vishing) Campaign with
Malware and tooling: Session, Tox
How Ongoing Help Desk Voice Phishing (Vishing) Campaign with works
The Canadian Centre for Cyber Security warns of an active vishing campaign against Canadian organizations, especially legal and financial firms, in which callers impersonating IT help desk steer victims to adversary-in-the-middle sign-in pages that relay credentials and MFA in real time. The activity matches Google Threat Intelligence Group's reporting on UNC6671 (BlackFile, later Redact/Pink/Helix/Falcon), a financially motivated cluster that steals cloud data via Microsoft Graph and scripted access and then extorts victims.
On 2026-10-28 the Canadian Centre for Cyber Security (Cyber Centre) published alert AL26-028 (page serial number shown as AV26-028) describing an ongoing voice-phishing campaign against Canadian organizations. Financial-sector targeting was observed from July 2026 and legal organizations became the focus in October 2026. Attackers contact staff by phone, Microsoft Teams or spoofed numbers, pose as internal IT/help desk, and cite urgent passkey migration, MFA enrollment or password changes. Callers may reference internal staff names or deadlines. Victims are sent to organization-branded adversary-in-the-middle (AitM) sign-in pages whose lure domains rotate frequently to evade blocklists; the pages relay credentials and MFA responses to the legitimate identity provider in real time. Domain patterns cited by the Cyber Centre are <org-name>.onetimesso[.]com, <org-name>.registermymfa[.]com, <org-name>sso[.]com and <org-name>internal[.]com, with keywords such as activate, enroll, register, passkey, okta, mfa, signin, security and portal.
Post-compromise activity per the Cyber Centre includes registration of attacker-controlled MFA methods, deletion of security notifications and password-reset alerts, automated scripts and Microsoft Graph abuse to exfiltrate Microsoft 365 and SaaS data, and extortion demands after data theft.
The Cyber Centre alert cites Google Cloud Threat Intelligence reporting on UNC6671. Google's May 2026 analysis of the BlackFile operation describes the same tradecraft: vishing from personal phones, AitM lookalike subdomains (e.g. enrollms, passkeyms, setupsso lookalikes registered via Tucows and used within minutes), real-time interception of Push/SMS/TOTP challenges, registration of an attacker MFA device, and exfiltration from Microsoft 365 and Okta-connected SaaS (SharePoint, OneDrive, executive mailboxes, Salesforce, Zendesk, ServiceNow, Entra directory). Exfiltration reuses captured session cookies with python-requests/2.28.1 and WindowsPowerShell/5.1 user agents; file reads are logged as FileAccessed rather than FileDownloaded, which can evade SOC logic keyed on download events. One intrusion exceeded 1 million files. Extortion began via Tox, moved to Session from February 2026 and, from March 2026, to hijacked internal email and Teams accounts, with 72-hour deadlines, spam, threatening voicemails to executives and swatting. The BlackFile leak site launched 2026-02-06 and announced it was shutting down 2026-05-11 'under this name'.
Google's August 2026 follow-up (as reported by trade press) links UNC6671 to the Redact, Pink, Helix and Falcon brands, shared root domains (passkeyhelpdesk[.]com, passkeydeploy[.]com), lookalike patterns such as addssopasskey and createssopasskey, spoofing of real help-desk numbers to request FIDO2 passkey enrollment, and a July 2026 shift to financial services, private equity and law firms. 18 BlackFile Bitcoin wallets received 141.65 BTC between 2026-01-07 and 2026-05-12. Attribution of the Canadian activity to UNC6671 is by consistency with public reporting; the Cyber Centre advisory itself lists only domain patterns and does not name the actor. Severity HIGH is an analyst assignment, not stated in the source. No CVE or CVSS applies.
MITRE ATT&CK techniques used in TL-2026-4667
Execution
T1059.001 PowerShell; T1059.006 Python
Defense Evasion
Command and Control
Persistence
Credential Access
T1111 Multi-Factor Authentication Interception; T1539 Steal Web Session Cookie; T1557 Adversary-in-the-Middle
Collection
T1114.002 Remote Email Collection; T1213.002 Sharepoint; T1530 Data from Cloud Storage
lateral-movement
Initial Access
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
Impact
Affected products and versions in Ongoing Help Desk Voice Phishing (Vishing) Campaign with
- Microsoft — Microsoft 365 / Entra ID / SharePoint / OneDrive
Vulnerable versions: Tenants without phishing-resistant MFA and conditional access - Okta — Okta Workforce Identity
Vulnerable versions: Tenants using push/SMS/TOTP MFA without phishing-resistant enforcement - Various — Connected SaaS (Salesforce, Zendesk, ServiceNow)
Vulnerable versions: SSO-integrated tenants reachable via a hijacked IdP session
Remediation for Ongoing Help Desk Voice Phishing (Vishing) Campaign with
Immediate actions
- Revoke sessions and tokens and reset credentials for any account suspected of compromise
- Review and remove unrecognized MFA methods and registered devices
- Preserve identity provider and Microsoft 365 audit logs
- Block lure domains matching the reported patterns and keywords (onetimesso, registermymfa, enrollms, passkeyms, setupsso, passkeyhelpdesk, passkeydeploy, addssopasskey, createssopasskey)
- Alert on FileAccessed/FileDownloaded events from python-requests, WindowsPowerShell or Go-http-client user agents
Workarounds
- Treat help desk-initiated passkey or MFA enrollment requests received by phone as untrusted until verified through a known channel
- Monitor system.multifactor.factor.setup events that follow failed or abandoned MFA challenges
Longer-term hardening
- Deploy phishing-resistant MFA (FIDO2 keys, device-bound passkeys, platform authenticators) and retire SMS/push MFA
- Enforce conditional access requiring managed devices
- Restrict sign-ins from VPNs, hosting providers and residential proxies
- Strengthen MFA reset verification and reduce session lifetimes
- Train staff to verify IT calls independently and provide a reporting channel for suspicious contacts
- Restrict external collaboration platform communications (e.g. Teams external access)
Timeline of Ongoing Help Desk Voice Phishing (Vishing) Campaign with
- Start of the period in which 18 BlackFile Bitcoin wallets were tracked receiving ransom payments (141.65 BTC through 2026-05-12), per Google Threat Intelligence Group.
- BlackFile data leak site launched; extortion contact moved from Tox to Session during February 2026.
- Example SharePoint FileDownloaded event from 179.43.185.226 with python-requests/2.28.1 user agent documented by Google as victim-tenant telemetry.
- Later intrusions logged as FileAccessed (not FileDownloaded) from the same IP and python-requests user agent; extortion shifted to hijacked internal email and Teams accounts from March 2026.
- BlackFile leak site briefly reactivated and announced it was shutting down 'under this name'.
- Google Cloud Threat Intelligence published 'BlackFile Vishing Extortion Operation' on UNC6671.
- Redact published a rebrand announcement and new data leak site; activity later also tied to Pink, Helix and Falcon brands.
- Targeting narrowed to financial services, private equity and legal firms (July 2026); Cyber Centre notes financial-sector targeting from July 2026.
- Google Threat Intelligence Group reported UNC6671's multi-brand operation and shared infrastructure.
- Canadian Centre for Cyber Security issued AL26-028 on the ongoing help desk vishing campaign, with legal organizations the October 2026 focus.
Sources cited for Ongoing Help Desk Voice Phishing (Vishing) Campaign with
- AL26-028 - Ongoing Help Desk Voice Phishing Campaign Targeting Canadian Organizations
- BlackFile Vishing Extortion Operation (Google Cloud Threat Intelligence)
- Google Links Redact Extortion Group to BlackFile Rebrand (Infosecurity Magazine)
- Financial Services Under Fire From Rebranded Extortionists (BankInfoSecurity)
- UNC6671 Runs Multi-Brand Vishing Extortion Against Financial and Legal Cloud Environments (Ampcus Cyber)
- Google Links UNC6671 to Cloud Extortion Brand Shift (IT Brief Australia)
- UNC6671 Hedge Fund Vishing SSO Cloud Extortion (Hexnode)
- BlackFile vishing brief (CraftedSignal)
Detection coverage for TL-2026-4667
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4667 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4667
5 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.