UNC6671 Rebrands After Millions in Extortion
UNC6671, a data extortion group previously operating under the BlackFile brand, has rebranded across four new fronts: Redact, Pink, Helix, and Falcon. The group targets enterprise employees via voice phishing, posing as IT helpdesk staff to push mandatory security migrations. Initial access relies on an AiTM Credential Harvesting Panel hosted on generic root domains that masquerade as passkey-related infrastructure, with victim-specific subdomains appended for targeted campaigns.
Victims span Financial Services, Healthcare, Legal, Private Equity, Retail, Technology, and Transportation. The group has generated millions in extortion revenue, prompting the multi-brand expansion after the BlackFile retirement announced in May 2026.
How the Vishing Attack Works
UNC6671 initiates the intrusion by calling target employees, posing as IT helpdesk staff to push a "mandatory, urgent security migration." The call directs the victim to a URL that loads an AiTM Credential Harvesting Panel hosted on a generic root domain—typically passkeyhelpdesk[.]com—masquerading as passkey-related infrastructure. For targeted campaigns, the actor appends a victim-specific subdomain to the root, so each employee gets a unique URL that ties the session to the specific target.
The panel harvests credentials from Microsoft 365 and Okta, enabling session hijacking and MFA bypass once the victim authenticates. Post-compromise TTPs remain consistent across all four brands—Redact, Pink, Helix, and Falcon—with shared infrastructure conduits linking the operations. The same root domain and panel template appear across multiple target organizations, creating a traceable chain between the extortion fronts.
The Four New Extortion Brands
Redact was the first of the four brands to appear, with the group publishing a blog post on a newly established Data Leak Site on June 27, 2026. The post explicitly denied that pressure from rival groups influenced the rebranding decision, a claim that aligns with the timing of the BlackFile retirement announced in May 2026.
Pink, Helix, and Falcon round out the set. All four brands share the same TTPs, victimology, and infrastructure, pointing to a single actor or a shared Phishing-as-a-Service setup. The group reuses the same generic root domain—passkeyhelpdesk[.]com—across multiple target organizations, creating a traceable chain between the extortion fronts. Falcon used the root domain to target at least one organization, with the other handled by Helix. The matching panel templates deployed across multiple DLS listings suggest the actor relies on a single credential harvesting template for all four brands.
Shared Infrastructure Links the Brands
UNC6671 reuses the same generic root domain across multiple target organizations, creating a traceable chain between the four extortion brands. The root domain, passkeyhelpdesk[.]com, masquerades as passkey-related infrastructure and is appended with victim-specific subdomains for targeted campaigns. Falcon used the root domain to target at least one organization, with the other handled by Helix.
Matching phishing templates are deployed across multiple DLS listings to harvest credentials for each brand. The same panel template appears across all four fronts, suggesting the actor relies on a single credential harvesting template for Redact, Pink, Helix, and Falcon. The shared infrastructure points to either splintered affiliates or a shared Phishing-as-a-Service setup, rather than isolated infrastructure per target.
~800 Malicious npm Packages Deliver Cross-Platform RAT
Precursor Intelligence has identified a cluster of nearly 800 malicious npm packages delivering a cross-platform remote access trojan (RAT) and infostealer targeting Windows, macOS, and Linux. The malware is a supply-chain compromise that drops a full RAT and infostealer on the victim’s machine after installation.
The npm packages are part of the same campaign as the Metabase zero-day and the UNC6671 rebrand, which the group has been running since May 2026. The actor is UNC6671, a data extortion group previously known as BlackFile, which has rebranded across four new fronts: Redact, Pink, Helix, and Falcon.
Apply the latest npm security updates immediately to mitigate the supply-chain attack. The packages are actively delivering the RAT/infostealer payload, so affected dependencies should be updated or pinned to a known-good version before the next install cycle.
Metabase SQLi Zero-Day Actively Exploited
A critical SQL injection vulnerability in Metabase, tracked as CVE-2026-63077, was actively exploited in zero-day attacks to breach customer instances at Framework and Tally. The flaw allows an attacker to inject SQL through the Metabase query interface, enabling data exfiltration from the backing database.
Review database access logs for suspicious SQL queries or data exfiltration. Rotate database credentials and review user permissions, then isolate affected Metabase instances from the network until patched.
Key points
- UNC6671 rebranded from BlackFile in May 2026 and now operates four new DLS brands: Redact, Pink, Helix, and Falcon.
- The group uses IT helpdesk voice phishing (vishing) to target enterprise employees, posing as mandatory security migration staff.
- Shared infrastructure across brands includes generic root domains like passkeyhelpdesk[.]com reused across multiple target organizations.
- Redact published its first DLS blog post on June 27, 2026, explicitly denying pressure from rival groups forced the rebrand.
- Targeting has expanded to financial services, private equity, and professional services, with data exfiltration from Microsoft 365 and Okta.