UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data

A recent wave of cyber attacks targeting financial services, private equity, and professional services has been attributed to a data extortion group known as UNC6671. "UNC6671 continues to rely on voice phishing (vishing) to target enterprise employees, posing as IT help desk staff facilitating mandatory, urgent security migrations. Significantly, the threat actor often contacts employees via

The article reports that UNC6671 is using voice phishing to impersonate IT help desk staff, often calling employees on personal phones, to harvest credentials, MFA tokens, and access to SaaS environments such as Microsoft 365 and Okta.[1][2] Google Threat Intelligence says the group then uses compromised sessions to exfiltrate data from cloud applications for extortion.[1][3] RealGround assessment: this is primarily a SaaS identity-and-data compromise risk, so defenders should prioritize phishing-resistant MFA, stronger help-desk verification, session controls, and logging for bulk export and MFA changes.