Picture a perfectly ordinary Tuesday afternoon in a law firm. A solicitor, let us call her Margaret, because she looks like a Margaret, is halfway through a cup of tea that has gone cold, as tea in law firms always does.
Her phone rings. It is IT.
Now, IT never rings. IT is a ticket number and an out-of-office reply. But this chap is lovely. He knows her name. He knows the name of the actual IT manager, and drops it in casually, the way you’d mention a mutual friend. He’s terribly sorry to bother her, but the firm is moving everyone to passkeys, she’s missed the deadline, and her account will be locked at five o’clock unless they sort it now. Together. Just a quick sign-in.
He sends her a link. The page has the firm’s logo on it. It looks exactly right, because, in a sense, it is.
Margaret signs in. She approves the prompt on her phone. The nice man thanks her and rings off.
And that, I’m afraid, is the end of the firm’s Tuesday.
The clever bit
The fake page is really a crooked waiter. You hand him your password and your MFA code; he carries them, perfectly politely, to the real Microsoft kitchen. The kitchen sends out a trusted session saying you are you. The waiter keeps the meal.
Nothing was cracked. Your MFA worked flawlessly, just for the wrong person. Once inside, the crooks add their own MFA device, delete the warning emails, hoover up SharePoint and OneDrive, and send the bill. Resetting the password alone is like changing the lock while the burglar sits in the kitchen with a spare key.
The true bit
In late October 2026 Canada’s Cyber Centre issued alert AL26-028 about an ongoing help-desk voice-phishing campaign against Canadian organisations, with October activity focused on the legal sector. The callers pose as internal IT or the help desk and push an urgent passkey move, MFA enrolment or password change. Calls come by phone and by Teams.
Google tracks the group behind this style of attack as UNC6671, better known as BlackFile. In May its leak site announced it was shutting down; it simply popped back up under new names, like a pantomime villain in a fresh moustache. Google traced about $10.7 million in ransom bitcoin to it.
If that feels familiar, it should. In 2023 MGM Resorts was floored after attackers reportedly rang its help desk pretending to be an employee, at a cost put at around $100 million. Now the crooks have flipped it: they call you, pretending to be the help desk.
What leaders should do
- Make “I’ll call you back” normal. A real caller waits. A crook, I’m told, tends to vanish.
- Treat surprise MFA or passkey changes as identity recovery, and confirm them on a separate, trusted channel.
- Restrict who outside the company can call or chat with staff on Teams.
- Remember that compromise means more than a password reset: revoke sessions and tokens, check for new MFA devices and mailbox rules, and review heavy Graph access.
The moral of the story
The attackers didn’t break anything. They didn’t need to. They borrowed a little authority, a little urgency and a real name, and asked nicely. The technology did exactly what it was told.
So here is this week’s homework, and it costs nothing: tell your people, out loud, that if IT ever calls asking them to change their password, MFA or passkey, the right answer is a cheerful “Grand, I’ll ring you back.”
Then watch how many of the callers never answer.
References
- Canadian Centre for Cyber Security, Alert AL26-028: Ongoing help desk voice phishing campaign targeting Canadian organizations.
- Google Threat Intelligence Group, UNC6671 targets financial services and enterprise cloud environments.
- BleepingComputer, Hedge fund cyberattacks tied to BlackFile-linked UNC6671 extortion group.
- The Hacker News, UNC6671 vishing attacks target personal devices.
- IT Brief UK, Google links UNC6671 to cloud extortion brand shift.
- Infosecurity Magazine, Attackers exploit Teams external chat to breach organizations in under 15 minutes (reporting Arctic Wolf research).
- Netwrix, MGM cyber attack: what happened (secondary account of the 2023 incident).