Skip to content
Threat Feed
Subscribe

Actor

UNC6671

3 briefs RSS
high threat

Microsoft 365 Adversary-in-the-Middle Token Replay Campaign

Threat actors are leveraging Adversary-in-the-Middle relays to capture M365 authentication tokens and bypass MFA, resulting in unauthorized account access, rogue device registration, and malicious inbox rule creation across multiple organizations.

exploited Microsoft 365 +1 UNC6671 phishing cloud-security aitm token-theft m365
4t 4i updated
high threat

Passkey-Themed Social Engineering Targeting Microsoft Cloud Identities

Threat actors are using passkey-themed phishing and adversary-in-the-middle attacks to compromise Microsoft cloud accounts, establish persistent access via registered MFA methods, and exfiltrate data via Microsoft Graph API.

SharePoint Online +3 UNC6671 phishing cloud-security credential-harvesting mfa-bypass data-exfiltration
3t 10i
high threat

UNC6671 BlackFile Vishing Extortion Campaign Targeting Microsoft 365 and Okta

UNC6671, operating under the "BlackFile" brand, conducts a sophisticated extortion campaign targeting organizations through voice phishing (vishing) and single sign-on (SSO) compromise, using adversary-in-the-middle (AiTM) techniques to bypass MFA and exfiltrate sensitive corporate data.

Microsoft 365 +5 UNC6671 vishing extortion aitm credential-theft data-exfiltration sso
2r 8t 5i