UNC6671’s BlackFile Vishing Campaign Targets Microsoft 365 & Okta – Defenders’ Response

What Happened

UNC6671, operating under the “BlackFile” moniker, began a coordinated vishing extortion campaign in early 2026. Attackers call victims, impersonating legitimate contacts, and trick them into revealing SSO credentials. Once the credentials are obtained, an adversary‑in‑the‑middle (AiTM) proxy is deployed to intercept authentication tokens, allowing the group to bypass MFA and gain full access to Microsoft 365 and Okta environments.

Impact

Dozens of organizations across North America, Australia, and the UK have been compromised. The attackers use Python and PowerShell scripts to harvest and exfiltrate sensitive data, which they later present as leverage for extortion demands. No product vulnerability is involved; the attack relies entirely on social engineering and credential theft.

Detection Tips

• Watch for outbound calls or emails that request login credentials or MFA codes.
• Enable and monitor MFA logs for repeated authentication attempts from unfamiliar IPs.
• Inspect SSO logs for anomalous token usage or repeated token refreshes.
• Flag any use of AiTM proxies or unexpected network tunnels in your logs.

Mitigation Steps

• Enforce MFA with strong, device‑based methods (e.g., hardware tokens or FIDO2).
• Deploy a trusted‑source verification process for all SSO credential requests.
• Block or quarantine traffic to domains registered by the attacker’s TOX channels.
• Educate staff on vishing tactics and require verification before sharing credentials.
• Implement continuous monitoring of SSO and MFA logs, and set alerts for suspicious patterns.

What to Do Now

Immediately review all recent SSO and MFA logs for signs of credential compromise. If you detect suspicious activity, revoke affected accounts, reset passwords, and enforce MFA. Notify your incident response team and consider engaging a threat‑intel partner to assess potential extortion demands.