[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnrTBDtu4AnEXlydrFgyi-j0BqZHNrz858p_MtpzZxJE":3},{"article":4,"iocs":55,"watch_terms":61,"solutions":62,"lesson":158},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"23716e48-76b8-4e0b-9fca-eb174ae93c79","UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data","unc6671-vishing-attacks-target-personal-phones-to-steal-saas-data-37859b","A recent wave of cyber attacks targeting financial services, private equity, and professional services is attributed to a data extortion group known as UNC6671. \"UNC6671 continues to rely on voice phishing (vishing) to target enterprise employees, posing as IT help desk staff facilitating mandatory, urgent security migrations. Significantly, the threat actor often contacts employees via their","The data extortion group UNC6671 is targeting financial, private equity, and professional services firms using vishing attacks. They impersonate IT staff to lure employees into fake login portals, capturing credentials and MFA tokens via adversary-in-the-middle infrastructure. The group then uses this access to exfiltrate data from SaaS applications like Microsoft 365 and Okta, operating under various extortion brands.","UNC6671 uses vishing to steal SaaS data by tricking employees into spoofed login portals.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Func6671-vishing-attacks-target-personal.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiL6-qu-cN6glV6XSy1IS7siHKdKPFmzqT3X8TQjGCa0RD33kfIQ8NfEBR5r8dbQvj1OS8L6T083igxfS1VO98xlg7MHIMysbfR_cVpdmPMcYibuMwDZ6SssIi3iryUznGL14zUByy7oRrTJe0AjgGMNti_Rcqezh7dtfyU31vyo-zft3fvR56SCsAfeHrm\u002Fs1600\u002Fvishing.jpg","2026-08-07T18:16:13+00:00","2026-08-07T20:00:21.582593+00:00",8,[17,20,22,24,27,29],{"name":18,"type":19},"UNC6671","threat_actor",{"name":21,"type":19},"ShinyHunters",{"name":23,"type":19},"Bling Libra",{"name":25,"type":26},"Microsoft 365","product",{"name":28,"type":26},"Okta",{"name":30,"type":31},"Google","vendor","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":54},{"id":32,"icon":34,"name":35,"slug":36},[56,59],{"type":52,"value":57,"context":58},"PowerShell scripts","Used for data exfiltration from enterprise cloud environments and SaaS applications.",{"type":52,"value":60,"context":58},"Python scripts",[30,25,28],{"controls":63,"vendors":147},[64,92,118],{"slug":65,"name":66,"problem":67,"products":68},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[69,77,84],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":78,"vendor_name":28,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":93,"name":94,"problem":95,"products":96},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[97,102,110],{"vendor_slug":78,"vendor_name":28,"vendor_logo":79,"product_slug":98,"product_name":99,"url":100,"description":101},"identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":119,"name":120,"problem":121,"products":122},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[123,131,139],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",[148,153,156],{"slug":149,"name":30,"logo_path":150,"roles":151},"google","\u002Fvendor-logos\u002Fgoogle.png",[152],"reported_by",{"slug":85,"name":86,"logo_path":87,"roles":154},[155],"affected",{"slug":78,"name":28,"logo_path":79,"roles":157},[155],{"slug":159,"title":160,"body":161,"framework_refs":162,"framework_notes":176},"vishing-attacks-exploit-human-trust-to-hijack-saas-credentials-and-mfa","Vishing Attacks Exploit Human Trust to Hijack SaaS Credentials and MFA","UNC6671 demonstrates how sophisticated social engineering via phone calls can bypass technical controls entirely by targeting the human element. By impersonating IT staff and directing employees to adversary-in-the-middle phishing portals, attackers capture both passwords and real-time MFA tokens before the victim realizes anything is wrong. This matters because once SaaS platforms like Microsoft 365 and Okta are compromised, attackers gain broad access to sensitive organizational data with legitimate credentials, making detection extremely difficult. The attack highlights that MFA alone is insufficient when users can be manipulated into surrendering tokens in real time.",[163,164,165,166,167,168,169,170,171,172,173,174,175],"CIS Control 14 – Security Awareness and Skills Training","CIS Control 6 – Access Control Management","CIS Control 10 – Malware Defenses","NIST SP 800-63B – Authentication and Lifecycle Management","NIST AC-2 – Account Management","NIST AC-17 – Remote Access","NIST SI-3 – Malicious Code Protection","NIST SP 800-177 – Trustworthy Email (phishing guidance)","MITRE ATT&CK T1566.004 – Phishing: Vishing","MITRE ATT&CK T1539 – Steal Web Session Cookie","GDPR Article 32 – Security of Processing","NIST CSF PR.AT-1 – Awareness and Training","NIST CSF DE.CM-3 – Personnel Activity Monitoring",{}]