🟠 High | Source: The Hacker News
A threat group called UNC6671 is conducting voice phishing (vishing) attacks against employees in financial services, private equity, and professional services, impersonating IT help desk staff to steal SaaS credentials and data. Attackers contact victims on their personal mobile phones, making traditional enterprise call-filtering controls ineffective. The end goal is data extortion, making this a significant threat to organisations handling sensitive client or financial data.
Security Architect’s Take: Implement out-of-band identity verification procedures for any IT help desk interaction involving credential resets or security migrations, and brief staff explicitly that legitimate IT will never request credentials or MFA codes via unsolicited calls. Review SaaS access policies to enforce phishing-resistant MFA (e.g. FIDO2) and consider restricting OAuth token issuance to known, managed devices to limit the blast radius if credentials are compromised.
Original advisory: UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data