# Ongoing Help Desk Voice Phishing (Vishing) Campaign with AitM MFA Relay Targeting Canadian Organizations (AL26-028) - UNC6671 / BlackFile

> The Canadian Centre for Cyber Security warns of an active vishing campaign against Canadian organizations, especially legal and financial firms, in which callers impersonating IT help desk steer victims to adversary-in-the-middle sign-in pages that relay credentials and MFA in real time. The activity matches Google Threat Intelligence Group's reporting on UNC6671 (BlackFile, later Redact/Pink/Helix/Falcon), a financially motivated cluster that steals cloud data via Microsoft Graph and scripted access and then extorts victims.

- **Published:** 2026-10-28T19:26:17Z
- **Last reviewed:** 2026-10-28T19:26:17Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4667
- **ID:** TL-2026-4667
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** UNC6671
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-28 the Canadian Centre for Cyber Security (Cyber Centre) published alert AL26-028 (page serial number shown as AV26-028) describing an ongoing voice-phishing campaign against Canadian organizations. Financial-sector targeting was observed from July 2026 and legal organizations became the focus in October 2026. Attackers contact staff by phone, Microsoft Teams or spoofed numbers, pose as internal IT/help desk, and cite urgent passkey migration, MFA enrollment or password changes. Callers may reference internal staff names or deadlines. Victims are sent to organization-branded adversary-in-the-middle (AitM) sign-in pages whose lure domains rotate frequently to evade blocklists; the pages relay credentials and MFA responses to the legitimate identity provider in real time. Domain patterns cited by the Cyber Centre are <org-name>.onetimesso[.]com, <org-name>.registermymfa[.]com, <org-name>sso[.]com and <org-name>internal[.]com, with keywords such as activate, enroll, register, passkey, okta, mfa, signin, security and portal.

Post-compromise activity per the Cyber Centre includes registration of attacker-controlled MFA methods, deletion of security notifications and password-reset alerts, automated scripts and Microsoft Graph abuse to exfiltrate Microsoft 365 and SaaS data, and extortion demands after data theft.

The Cyber Centre alert cites Google Cloud Threat Intelligence reporting on UNC6671. Google's May 2026 analysis of the BlackFile operation describes the same tradecraft: vishing from personal phones, AitM lookalike subdomains (e.g. enrollms, passkeyms, setupsso lookalikes registered via Tucows and used within minutes), real-time interception of Push/SMS/TOTP challenges, registration of an attacker MFA device, and exfiltration from Microsoft 365 and Okta-connected SaaS (SharePoint, OneDrive, executive mailboxes, Salesforce, Zendesk, ServiceNow, Entra directory). Exfiltration reuses captured session cookies with python-requests/2.28.1 and WindowsPowerShell/5.1 user agents; file reads are logged as FileAccessed rather than FileDownloaded, which can evade SOC logic keyed on download events. One intrusion exceeded 1 million files. Extortion began via Tox, moved to Session from February 2026 and, from March 2026, to hijacked internal email and Teams accounts, with 72-hour deadlines, spam, threatening voicemails to executives and swatting. The BlackFile leak site launched 2026-02-06 and announced it was shutting down 2026-05-11 'under this name'.

Google's August 2026 follow-up (as reported by trade press) links UNC6671 to the Redact, Pink, Helix and Falcon brands, shared root domains (passkeyhelpdesk[.]com, passkeydeploy[.]com), lookalike patterns such as addssopasskey and createssopasskey, spoofing of real help-desk numbers to request FIDO2 passkey enrollment, and a July 2026 shift to financial services, private equity and law firms. 18 BlackFile Bitcoin wallets received 141.65 BTC between 2026-01-07 and 2026-05-12. Attribution of the Canadian activity to UNC6671 is by consistency with public reporting; the Cyber Centre advisory itself lists only domain patterns and does not name the actor. Severity HIGH is an analyst assignment, not stated in the source. No CVE or CVSS applies.

## MITRE ATT&CK

- T1583.001 Domains
- T1566.004 Spearphishing Voice
- T1557 Adversary-in-the-Middle
- T1111 Multi-Factor Authentication Interception
- T1539 Steal Web Session Cookie
- T1550.004 Web Session Cookie
- T1078.004 Cloud Accounts
- T1098.005 Device Registration
- T1059.001 PowerShell
- T1059.006 Python
- T1213.002 Sharepoint
- T1530 Data from Cloud Storage
- T1114.002 Remote Email Collection
- T1567 Exfiltration Over Web Service
- T1090.003 Multi-hop Proxy
- T1657 Financial Theft

## Sources

- [AL26-028 - Ongoing Help Desk Voice Phishing Campaign Targeting Canadian Organizations](https://cyber.gc.ca/en/alerts-advisories/al26-028-ongoing-help-desk-voice-phishing-campaign-targeting-canadian-organizations)
- [BlackFile Vishing Extortion Operation (Google Cloud Threat Intelligence)](https://cloud.google.com/blog/topics/threat-intelligence/blackfile-vishing-extortion-operation)
- [Google Links Redact Extortion Group to BlackFile Rebrand (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/redact-extortion-group-blackfile/)
- [Financial Services Under Fire From Rebranded Extortionists (BankInfoSecurity)](https://www.bankinfosecurity.com/financial-services-under-fire-from-rebranded-extortionists-a-32464)
- [UNC6671 Runs Multi-Brand Vishing Extortion Against Financial and Legal Cloud Environments (Ampcus Cyber)](https://www.ampcuscyber.com/shadowopsintel/runs-multi-brand-vishing-extortion-against-financial-and-legal-cloud-environments/)
- [Google Links UNC6671 to Cloud Extortion Brand Shift (IT Brief Australia)](https://itbrief.com.au/story/google-links-unc6671-to-cloud-extortion-brand-shift)
- [UNC6671 Hedge Fund Vishing SSO Cloud Extortion (Hexnode)](https://www.hexnode.com/blogs/unc6671-hedge-fund-vishing-sso-cloud-extortion/)
- [BlackFile vishing brief (CraftedSignal)](https://feed.craftedsignal.io/briefs/2026-05-blackfile-vishing/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4667