UNC6671 Uses Vishing to Steal Enterprise SaaS Data

Campaigns attributed to UNC6671 target enterprise employees with vishing calls in which the callers impersonate IT help-desk staff and direct victims to spoofed login pages. Adversary-in-the-middle infrastructure captures credentials, MFA tokens and active session tokens, which are used to steal data from cloud and SaaS environments, including Microsoft 365 and Okta, and to conduct extortion.