The fake IT helpdesk call now asks you to enroll a passkey

Google Threat Intelligence Group published a report on August 6, 2026 on UNC6671, a financially motivated group previously tracked as BlackFile and now operating as REDACT alongside several extortion brands. The technique is the reason to read it: callers phone employees on their personal cellphones, pose as coworkers or IT helpdesk staff, and tell them there is an urgent mandatory security migration to passkeys or multi-factor authentication that they need to complete now.

How the call becomes a breach

The victim is steered to a spoofed single sign-on portal, following a naming pattern Google documents as company-name followed by createssopasskey, sitting behind adversary-in-the-middle infrastructure. That proxy relays the login in real time, so it captures both the credentials and the multi-factor token as the victim hands them over, which is what defeats ordinary MFA. From there the group runs scripted mass exfiltration against Microsoft 365 and Okta-connected applications, with python-requests and PowerShell fingerprints visible in unified audit log telemetry, and then extorts the victim.

Two details that make it work

The first is the personal phone. Calling someone's own mobile routes around every corporate control on the books, because none of them apply to a call the company never sees. The second is the pretext. Security-awareness training has spent a decade teaching people that IT will never ask for your password, and this call does not ask for a password. It asks you to strengthen your account, which is the thing your employer has been nagging you to do, delivered by someone who sounds like the person whose job it is to nag you.

What Google says to do about it

The recommendations are concrete: genuinely phishing-resistant FIDO2 rather than MFA in general, authentication bound to trusted devices and networks so a relayed session fails, session controls, and monitoring identity-provider logs for the exfiltration fingerprints. Note that the defence and the lure are the same technology. Real FIDO2 enrolment defeats this attack precisely because the credential is bound to an origin the proxy cannot spoof, which is why the attackers ask you to do it on their site instead.

Why a build studio cares

Anyone shipping authentication is now designing against an attacker who will phone the user. That argues for origin-bound credentials over anything relayable, and against enrolment flows that can be completed entirely on a link somebody sent you. It is also a reminder that the human-facing part of an auth system is part of the system: if your legitimate security-upgrade emails look and sound exactly like this attack, you have made the attack easier, and that is a design problem rather than a training problem.

Next step: read Google's threat intelligence report for the indicators, and check your own enrolment flow against it. If you want authentication built so a convincing phone call is not enough, write to us at hello@gattyworks.com.