A cybercrime group, identified as UNC6671, has reportedly launched a series of vishing attacks aimed at employees' personal phones to compromise Software-as-a-Service (SaaS) data. The attacks involve the impersonation of IT support personnel, with the ultimate goal of tricking individuals into divulging credentials and multi-factor authentication (MFA) tokens through fraudulent login portals.
The reported modus operandi indicates a multi-stage attack. Initially, UNC6671 engages in vishing, a form of social engineering conducted over the phone, to establish contact with targets. During these calls, the attackers pose as legitimate IT support staff, likely leveraging pretexting to build trust and urgency. The objective of these calls is to direct victims to malicious login pages designed to mimic legitimate corporate or SaaS provider authentication portals.
Upon reaching these fraudulent portals, victims are prompted to enter their credentials. Crucially, the attacks are sophisticated enough to also capture multi-factor authentication tokens. This suggests the use of real-time phishing kits or proxy-based attacks that intercept and relay MFA challenges and responses, effectively bypassing this critical security layer. Once both credentials and MFA tokens are obtained, UNC6671 gains unauthorized access to the victims' cloud environments.
The compromised cloud environments specifically mentioned include Microsoft 365 and Okta, indicating a focus on widely adopted enterprise SaaS platforms. With access to these environments, the group reportedly deploys scripts. These scripts are then utilized for data exfiltration, suggesting automated or semi-automated processes to identify, collect, and transfer sensitive information out of the compromised cloud applications.
This class of attack, relying heavily on social engineering and credential theft, is a persistent threat to organizations. Vishing often exploits human trust and can bypass technical controls that might detect email-based phishing. The targeting of personal phones further complicates detection, as corporate security tools may not monitor these devices as closely.
Mitigation strategies for such threats typically involve robust employee security awareness training, emphasizing the dangers of unsolicited calls, the importance of verifying caller identity, and the need to always access login portals through known, legitimate channels rather than links provided over the phone. Implementing phishing-resistant MFA methods, such as FIDO2 security keys, can also significantly reduce the effectiveness of credential and MFA token theft.
The activities of groups like UNC6671 highlight the evolving landscape of cyber threats, where attackers increasingly blend social engineering with technical exploits to bypass security measures. The focus on SaaS data underscores the value of information stored in cloud environments and the continuous need for vigilance and comprehensive security strategies that address both human and technological vulnerabilities.
