Pink Extortion Group Targets Enterprise Users With Vishing and Cloud Data Theft

A new extortion brand called Pink is targeting enterprise users through voice phishing and fake IT support calls to steal credentials, MFA codes, and cloud-hosted business data.

Unit 42 tracks the activity as CL-CRI-1147 and says the group is likely tied to the broader Com cybercrime ecosystem. The Unit 42 threat intelligence note says Pink’s leak site went live on May 31, 2026 and already listed multiple victims.

The group’s main tactic is not malware deployment. Pink uses social engineering to convince employees that they are speaking with internal IT staff, then directs them to phishing pages that capture credentials and MFA information.

Pink uses fake IT calls to steal Microsoft 365 access

After gaining access to a victim account, Pink quickly moves into cloud productivity platforms. Unit 42 says the group identifies and exfiltrates data from services such as SharePoint and OneDrive, then uses compromised accounts to send extortion emails and Microsoft Teams messages.

The Register reported that Pink uses a playbook similar to other social-engineering groups, including actors associated with Lapsus$, Scattered Spider, and ShinyHunters. These groups focus on people, help desks, and identity systems rather than traditional perimeter exploits.

The approach is effective because the activity can look like normal user behavior. If attackers sign in with a real account and use Microsoft 365 APIs or built-in tools to access files, some security tools may not treat the activity as malware.

Attack stage	Observed Pink behavior
Initial access	Vishing and fake IT impersonation
Credential theft	Phishing pages collect credentials and MFA information
Cloud access	Compromised accounts access SharePoint and OneDrive data
Exfiltration	Files are pulled from enterprise cloud storage
Extortion	Attackers send emails and Teams messages from compromised accounts

Google says Pink may be tied to BlackFile

Unit 42 identified Pink as a new extortion brand, but attribution remains more complicated. Google Threat Intelligence told The Register that Pink may represent a continuation or rebrand of earlier activity linked to BlackFile and Redact.

Google’s earlier BlackFile investigation described a related vishing extortion operation that targeted Microsoft 365, Okta, SharePoint, OneDrive, Salesforce, and Zendesk environments. The group used adversary-in-the-middle phishing, MFA bypass, and stolen identity access to steal SaaS data.

Google also noted that BlackFile’s data leak site went offline in late April 2026 and briefly returned on May 11 with a message saying the brand was shutting down under that name. That makes a possible rebrand plausible, though defenders should focus on the tactics and infrastructure rather than the name alone.

• Unit 42 tracks Pink as CL-CRI-1147.
• The group is assessed as likely Com-affiliated.
• Google says Pink may overlap with UNC6671, BlackFile, and Redact activity.
• The group focuses on cloud data theft and extortion, not encryption-first ransomware.

Why vishing still works against enterprises

Vishing works because it targets trust, urgency, and help desk routines. An attacker can pretend to be an IT employee, reference a real company process, and push a victim to act before they verify the request.

In Pink’s case, the attackers reportedly use phishing domains with passkey-themed names. That theme can make the request sound like a legitimate authentication upgrade, especially if a company is already rolling out passkeys or MFA changes.

Microsoft says passkeys and FIDO2 authentication help prevent remote phishing because they use origin-bound public key cryptography. This means credentials cannot simply be replayed on an attacker-controlled site the way passwords and one-time codes can.

Phishing method	Why it is risky	Better control
Password theft	Attackers can reuse stolen passwords	Passwordless or FIDO2 authentication
SMS or TOTP code theft	Attackers can relay codes in real time	Phishing-resistant MFA
Push fatigue	Users may approve a request under pressure	Number matching, risk-based controls, and passkeys
Help desk impersonation	Employees may trust a caller who sounds internal	Strict caller verification procedures

Cloud storage data theft happens quickly

Once attackers control a valid account, they can use Microsoft 365 APIs and automation to access large volumes of files. That makes cloud storage monitoring just as important as endpoint detection.

Microsoft’s Office 365 Management Activity API schema includes events such as FileDownloaded, FileAccessed, and OneDrive sync-related downloads. These events can help security teams detect unusual SharePoint and OneDrive activity.

Security teams should watch for spikes in file access, downloads from unusual IP addresses, new user agents, impossible travel, and scripted activity from accounts that normally browse files interactively.

• Monitor SharePoint and OneDrive for high-volume file access.
• Review Microsoft Graph and scripting user agents in audit logs.
• Alert when a user downloads or accesses far more files than normal.
• Correlate cloud activity with suspicious MFA events and new sign-in locations.
• Review Teams and email messages sent by compromised users after unusual file access.

Pink’s extortion pressure comes from inside trusted accounts

Pink’s use of compromised Microsoft Teams messages and internal email makes the extortion attempt more disruptive. A message from a real employee account can create urgency and confusion inside the victim organization.

The Unit 42 indicators say the actor used compromised victim accounts to send the initial extortion email and internal Teams messages. Unit 42 also noted a 72-hour deadline in one extortion negotiation, a common pressure tactic in these cases.

This creates a response challenge. Organizations must treat the incident as both an identity compromise and a data theft event. Resetting the user’s password alone may not be enough if attackers captured session tokens, registered MFA methods, or granted suspicious OAuth access.

Indicators linked to Pink activity

Unit 42 published phishing domains, IP addresses, and user-agent strings tied to Pink activity. The indicators below are defanged where appropriate and should support hunting, blocking, and enrichment.

Indicators can change quickly, so defenders should combine them with behavior-based detections. A clean match does not prove compromise by itself, and no single domain or IP list will cover future infrastructure.

Type	Indicator	Context
Domain	passkeyadd[.]com	Phishing domain used in credential and MFA theft activity
Domain	passkeydeploy[.]com	Phishing domain tied to Pink infrastructure
Domain	deploypasskey[.]com	Passkey-themed phishing domain
IP address	185[.]178.208[.]153	Hosted phishing domains
IP address	172[.]93.100[.]252	Accessed compromised accounts
IP address	96[.]232.20[.]66	Residential proxy IP tied to extortion email creation
User agent	Microsoft.Graph.Client/5.62.0	Observed during exfiltration activity
User agent	python-requests/2.28.1	Observed during exfiltration activity
User agent	python-requests/2.33.1	Observed during exfiltration activity

How organizations can reduce exposure

The strongest defense starts with identity controls. Microsoft recommends moving toward phishing-resistant passkeys and FIDO2 security keys because they reduce the risk from password and code relay attacks.

Organizations should also harden help desk workflows. Any request to reset MFA, enroll a device, change recovery details, or visit an authentication link should require verification through a separate trusted channel.

Google’s BlackFile guidance also recommends monitoring identity provider logs for suspicious MFA setup events, watching for authentication attempts from unusual commercial VPN or hosting providers, and auditing SaaS API activity for high-volume file access.

Control	Why it helps
Phishing-resistant MFA	Reduces the value of stolen passwords and one-time codes
Strict help desk verification	Stops attackers from socially engineering account recovery
Conditional Access policies	Limits suspicious sign-ins from risky devices, regions, or networks
SaaS audit monitoring	Detects high-volume file access and unusual API behavior
OAuth app review	Finds suspicious delegated access that can survive password resets

What incident responders should check first

Teams responding to possible Pink activity should first identify the compromised user accounts, the phishing domain used, the MFA events involved, and the time window of cloud file access.

Microsoft’s audit schema can help defenders map SharePoint and OneDrive file activity, including downloads and access events, into SIEM detections and incident timelines.

Responders should revoke sessions, reset credentials, remove suspicious MFA methods, review OAuth grants, and search for Teams or email messages sent from compromised accounts. They should also preserve logs before attackers or automated retention policies remove useful evidence.

• Revoke active sessions for affected accounts.
• Reset credentials and remove attacker-registered MFA methods.
• Review sign-ins, MFA events, OAuth grants, and device registrations.
• Search for unusual SharePoint, OneDrive, Teams, and email activity.
• Notify employees about the specific vishing script and phishing domains used.
• Preserve audit logs for legal, compliance, and insurance review.

Why Pink matters

Pink shows how enterprise extortion continues to move away from simple malware deployment and toward identity-driven SaaS compromise. Attackers do not always need to encrypt endpoints if they can steal sensitive cloud files and threaten public disclosure.

The same pattern has appeared across recent Com-linked activity. The Register’s coverage notes that Pink follows a familiar phone-based intrusion model that other crews have used against major companies in recent years.

For defenders, the lesson is clear. Security teams need to treat vishing, help desk abuse, MFA reset fraud, and cloud file exfiltration as one connected threat path. Blocking one phishing domain helps, but stronger identity controls and cloud activity monitoring matter more.

FAQ