UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data

UNC6671 demonstrates how sophisticated social engineering via phone calls can bypass technical controls entirely by targeting the human element. By impersonating IT staff and directing employees to adversary-in-the-middle phishing portals, attackers capture both passwords and real-time MFA tokens before the victim realizes anything is wrong. This matters because once SaaS platforms like Microsoft 365 and Okta are compromised, attackers gain broad access to sensitive organizational data with legitimate credentials, making detection extremely difficult. The attack highlights that MFA alone is insufficient when users can be manipulated into surrendering tokens in real time.