{"id":60798,"date":"2026-06-04T22:16:55","date_gmt":"2026-06-04T22:16:55","guid":{"rendered":"https:\/\/www.theregister.com\/a\/5251434"},"modified":"2026-06-04T22:16:55","modified_gmt":"2026-06-04T22:16:55","slug":"pink-is-the-latest-goon-squad-to-use-fake-helpdesk-calls-to-steal-creds","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/pink-is-the-latest-goon-squad-to-use-fake-helpdesk-calls-to-steal-creds\/","title":{"rendered":"Pink is the latest goon squad to use fake helpdesk calls to steal creds"},"content":{"rendered":"
<\/div>\n
\n

CYBER-CRIME<\/p>\n

A familiar tactic popularized by chaotic crime crew Lapsus$<\/p>\n<\/p><\/div>\n

\n

UPDATED<\/span> <\/span>A new extortion brand called Pink \u2013 which may be a rebrand of BlackFile \u2013 uses voice phishing and fake help-desk calls to gain initial access to organizations\u2019 IT environments, steal their sensitive data, and threaten to leak it unless the victims pay a ransom demand.<\/p>\n

Palo Alto Networks’ Unit 42 first spotted the gang, which it tracks as cluster CL-CRI-1147, and its data-leak site, which went live on May 31. \u201cPink uses vishing and IT impersonation to phish credentials\/MFA, then exfiltrates enterprise cloud storage and productivity data to extort victims,\u201d the threat-intelligence biz said<\/a> in a LinkedIn post.<\/p>\n

Google Threat Intelligence is not so sure it’s a new gang, however. <\/p>\n

“After retiring the BlackFile brand in May 2026, we assess the group launched the ‘Redact’ brand and has now potentially surfaced as ‘Pink,,” Austin Larsen, Principal Threat Analyst at Google Threat Intelligence Group, told us. “This new operation exhibits hallmarks of UNC6671, including similar credential-harvesting infrastructure, data leak site (DLS), and recurring messaging that claims to ‘improve the security’ of victims who pay. Additionally, we attribute the Pink (CL-CRI-1147) domains recently published by Unit42 to UNC6671.”<\/p>\n

Regardless whether it’s brand new or just a new coat of paint, the tactics are very familiar.  Pink is one of many goon squads<\/a> to use these social-engineering tactics<\/a> to steal employees\u2019 credentials and bypass multi-factor authentication, using this access to burgle companies\u2019 cloud storage and databases. <\/p>\n

Chaotic crime crew Lapsus$, during its 2021 and 2022 extortion spree that hit Nvidia<\/a>, Microsoft<\/a>, and Okta<\/a>, among others, popularized this style of phone-based intrusions before Scattered Spider<\/a> picked up the mantle. Scattered Spider is perhaps best known for its 2023 Las Vegas casino digital heists<\/a>, and reportedly bragged that all it took to break into MGM’s networks was a 10-minute call with the help desk.<\/p>\n

Over the last few years, ShinyHunters has used this same playbook to steal sensitive data from Ticketmaster,<\/a> AT&T<\/a>, and other Salesforce customers<\/a>, and thousands of schools and universities<\/a> that use Canvas\u2019 digital learning platform.<\/p>\n

Despite multiple arrests<\/a> across all three gangs, they keep coming back to victimize more organizations. Most incident responders, including Google\u2019s Mandiant and Unit 42, link many of <\/span>these criminal collectives to The Com<\/a>, a loosely knit group of primarily English speakers made up of several interconnected networks of hackers, SIM swappers, and extortionists, with some of its subgroups offering real-life violent crime for hire.<\/p>\n

According to Unit 42, this latest cluster of extortion activity is also \u201clikely a Com-affiliated actor.\u201d And after investigating \u201cmultiple\u201d of these extortion attacks over the past few months, on Monday, they spotted something that led them to Pink\u2019s name-and-shame website.<\/p>\n

\u201cOn June 1, 2026, an existing extortion negotiation that had never received a response, attributed to a likely Com-related cluster, received new communication from a threat actor via a free webmail account,\u201d Unit 42 analysts Richard Emerson and Cuong Dinh said<\/a> in a Wednesday threat-intel post. \u201cThe actor provided a new qTox ID and a leak site associated with the Pink brand, but referenced exfiltrating almost identical information from the original extortion notice.\u201d<\/p>\n

Pink data thieves set a 72-hour deadline for the victim to respond before leaking the stolen goods.<\/p>\n

After gaining access to the victim\u2019s account, the criminals snoop around for valuable corporate and customer data from platforms like SharePoint and OneDrive. After exfiltrating the stolen files, Pink attackers use compromised victim accounts and internal Teams messages to extort the company.<\/p>\n

\u201cThe actor reuses second-level domains to target multiple organizations, and the third-level domain typically thematically represents the target,\u201d Emerson and Dinh wrote.<\/p>\n

They also listed the following phishing domains as indicators of compromise: <\/p>\n