Increased attention has been called to a sustained adversary-in-the-middle (AitM) phishing and vishing operation targeting financial services, professional services, energy and technology organizations since at least April 2026. This activity aligns with the threat cluster publicly designated UNC6671 by Google Threat Intelligence Group and O-UNC-045 / CORDIAL SPIDER by Okta Threat Intelligence, operating under extortion brands including Falcon, Helix, Pink and Redact (formerly BlackFile).

TL;DR – A sustained AitM operation has been targeting financial services, legal and other industries since April under extortion brands including Falcon, Helix, Pink and Redact (formerly BlackFile). This blog breaks down the threat actor infrastructure and behavior to inform proactive and retroactive hunts, as well as the threat actor’s standing tactics, techniques, tools and procedures.

This post aggregates findings from our independent infrastructure analysis with those published by GTIG and Okta and extends the public picture with additional infrastructure, victim targeting data and phishing kit fingerprints not previously published.

Key findings:

UNC6671 / CORDIAL SPIDER is a financially motivated threat actor whose primary objective is bulk cloud data exfiltration followed by data extortion. No encryption or traditional ransomware deployment has been observed as part of these referenced operations. The threat group uses voice phishing (vishing) as its initial access vector. For this attack, callers impersonate IT helpdesk personnel and direct employees to AiTM credential-harvesting pages that transparently proxy real authentication flows, intercepting session tokens in real time and thereby bypassing multi-factor authentication (MFA) entirely.

Google Threat Intelligence previously documented the actor’s diversification across multiple extortion brands following the claimed shutdown of the BlackFile brand in May 2026. It noted that shared infrastructure, phishing templates and victim targeting patterns link these brands to a common operator cluster.

Okta subsequently published a detailed technical analysis of the Work Panel platform itself. They describe it as a multi-tenant cybercrime-as-a-service console with role-based access control, integrated target reconnaissance via commercial B2B data APIs, automated infrastructure provisioning and real-time credential relay management.

Our analysis corroborates and extends both reports.

Infrastructure and passive DNS analysis reveals a campaign that began no later than April 21, 2026 and remains active at the time of this publication. Key timeline statistics include:

The sector distribution of targeted organizations shifted materially over the campaign window:

This progressive focus on organizations holding sensitive deal, portfolio and market intelligence is consistent with GTIG’s observation that the actor appears to be “prioritizing entities whose data maximizes leverage in extortion demands.”

Importantly, we note that this operational focus on deliberate targets, amplified by customized domains and phishing pages, departs from the most common forms of opportunistic ransomware and data theft. It also mirrors the SaaS exploitation focus of other groups, including Shiny Hunters.

All observed phishing pages are delivered through Cloudflare CDN (AS13335), which proxies the origin infrastructure and conceals the actor’s backend servers from direct observation. Domains are registered through NICENIC INTERNATIONAL GROUP CO., LIMITED (IANA 3765) for the primary campaign wave, with a secondary cluster registered through Tucows Domains for panel infrastructure.

A consistent NICENIC registrant account identifier links the following infrastructure categories to a single operator account:

Domains use Cloudflare nameservers and are unsigned (no DNSSEC). The TLS certificates are issued by Let’s Encrypt at domain registration time, typically within hours of NICENIC registration.

Two servers on AS51852 (Private Layer INC) serve as the primary AiTM relay nodes, consistent with GTIG’s published IOC table:

Both servers run Caddy as a web server, which handles HTTPS termination and reverse-proxying of phishing traffic to the underlying Node.js processes managed by PM2. This is consistent with the Work Panel architecture described by Okta. Shodan additionally identifies an unidentified proxy-type service responding on port 443, returning HTTP/1.0 400 Bad Request to direct probes. The precise function of this component is not determined from banner data alone and may represent an operator access channel or an artifact of how Caddy responds to unauthenticated probes.

Both servers run Ubuntu 24.04 LTS and expose SSH (OpenSSH 9.6p1). Neither server has appeared in abuse databases or internet scanning datasets, consistent with purpose-provisioned infrastructure under deliberate low-profile operational management.

A third server on the same AS51852 subnet (31.7.56[.]229) runs Debian 13 and hosts:

A fourth Private Layer server (179.43.171[.]18, AS51852) exposes only RDP on port 3389 and runs Windows 11 (Build 26100). The self-signed RDP TLS certificate identifies the hostname as WIN-FTG8SJVH62P, a default auto-generated Windows hostname indicative of a freshly provisioned virtual machine. This server’s exclusive RDP exposure and default Windows configuration is consistent with an operator-accessed remote working environment rather than a phishing delivery or relay node.

As described in detail by Okta, Work Panel is a role-based operator console that automates the full vishing campaign lifecycle: target reconnaissance (via RocketReach B2B data API), domain registration (directly through the NICENIC API), phishing site deployment, AiTM session management and credential capture. The platform segregates operators into caller, manager and admin roles, ensuring callers cannot access captured credentials.

We identified three distinct Work Panel deployments across the campaign timeline:

|

Domain

|

First Seen

|

Hosting

|

Status

|

|---|---|---|---|

|

betterdays2828199[.]com |

2026-04-10

|

Cloudflare (NameSilo registered) |

Earliest known panel

|

|

panel.sqfepjvmrd[.]xyz |

2026-07-10 |

31.7.56.61 (Private Layer) |

Last seen 2026-07-30; now suspended

|

|

panel.whatarewedoingwiththesedomainshello[.]com |

~2026-06-03 |

31.7.56.52 (Private Layer) |

Tucows/Njalla registered

|

The domain name whatarewedoingwiththesedomainshello[.]com, which is registered through Tucows using Njalla privacy nameservers, presents a tongue-in-cheek comment and possible operational security failure. It also provides a unique behavioral signature for this cluster. The Tucows/Njalla/Saint Kitts and Nevis (KN) registration pattern for this domain is shared with at least one other infrastructure domain in the cluster.

A domain constructed to impersonate AWS SMTP relay infrastructure (aws-us-smtp[.]com, registered 2026-04-26) is linked to the same NICENIC operator account as the phishing domains. Consistent with Okta’s description of the Work Panel email channel, this domain serves as the configured SMTP sender for operator-composed phishing pre-texts sent ahead of vishing calls.

The Work Panel kit serves two phishing templates depending on the target organization’s identity provider:

Both templates share a common backend PHP endpoint (api_FyekIDWY.php) that handles session heartbeating, credential relay polling and AiTM session management. This endpoint is called repeatedly during a victim’s authentication session and produces a static 28-byte JSON response with a deterministic ETag value.

The following fingerprints provide high-confidence detection of Work Panel phishing pages:

|

Fingerprint

|

Type

|

Hits (URLScan)

|

Template Coverage

|

|---|---|---|---|

|

api_FyekIDWY.php |

PHP endpoint filename

|

118 |

Both Okta + M365

|

|

API response hash c51eb785... |

HTTP response content hash

|

115

|

Both Okta + M365

|

|

d15faff9a15a05e605bc9cfadacdfb4f16ff2c9d.svg |

SHA1-named static asset

|

70

|

Okta only

|

|

okta-logo-end-user-dashboard.svg |

Named static asset

|

66

|

Okta only

|

|

M365 page hash 275a824c... |

HTTP response content hash

|

34

|

M365 only

|

Note on api_FyekIDWY.php: The randomized PHP filename (FyekIDWY) is an artifact of the specific Work Panel build version deployed during this campaign. This filename is not present on any legitimate website in passive scan databases, making it a reliable network detection indicator. The ETag header value W/”1c-xHTlhvqhxGIJKu5AJR5p+il839Y” on responses from this endpoint is equally distinctive and detectable at the network layer without filename inspection.

|

Sector

|

Organizations Targeted

|

|---|---|

|

Hedge Funds / Quantitative Finance |

10

|

|

Venture Capital / Private Equity |

9

|

|

Legal (law firms) |

9

|

|

Financial Services (diversified) |

8

|

|

Asset Management |

5

|

|

Energy |

5

|

|

Technology / Semiconductors |

6

|

|

Media / Entertainment |

5

|

|

Insurance |

6

|

|

Healthcare / Medical Devices |

4

|

|

Consumer Goods |

4

|

|

Transportation / Logistics |

2

|

|

Other |

5

|

The kit’s static assets share consistent last-modified timestamps indicating the Okta template base was deployed on April 18, 2026, with specific branding layers added on April 20, 2026 and the credential-relay JavaScript (client.js) deployed on April 22, 2026.

Across 110 days of observed activity, we identified 78 unique victim-targeted phishing subdomains representing 76 distinct organizations. Six organizations were targeted on two separate domain deployments, suggesting either initial blocking triggered re-deployment or deliberate parallel infrastructure saturation.

Sector breakdown:

The progressive concentration toward hedge funds, private equity and venture capital firms across the campaign window reflects a deliberate strategic choice. These organizations hold non-public portfolio company data, pending transaction intelligence and investor information. This is all material whose unauthorized disclosure creates strong extortion leverage.

The targeting of nine law firms, including several ranked among the largest in the United States by revenue, is also notable. Law firms represent a high-value credential target because compromised employee sessions provide access not only to the firm’s own data but potentially to privileged client communications, transaction documents and litigation strategy. Several of the targeted firms have active practices in Mergers and Acquisitions (M&A), capital markets and regulatory enforcement, areas where non-public information commands significant value.

The most recent infrastructure cluster (myssoapps.com, registered August 7, 2026 — the day after GTIG’s and Okta’s publications) demonstrates the actor’s operational resilience. New domains were provisioned and active phishing sessions were observed within approximately 24 hours of the cluster’s registration.

Forensically, this threat group operates similarly to other SaaS-focused data extortion groups such as Shiny Hunters. Once the threat actor has successfully authenticated to a victim’s Okta account using the victim-derived One-Time Password (OTP), they are most frequently observed pivoting to Microsoft 365, Salesforce and other SaaS infrastructure to which their OAuth Token grants them access.

Post-exploitation compromise has been observed from Private Layer INC (ASN AS51852) infrastructure, consistent with the actor’s preference in back-end infrastructure. Additionally, we have repeatedly observed the threat actor deleting concurrent security warnings delivered by email, almost certainly as an evasive action to prevent user scrutiny of the account abuse or fraudulent logins.

After eviction of successful exfiltration data, the threat actors delivered extortion emails to victims, outlining the alleged breadth of their data exfiltration and directing the victim to contact them via TOX by a pre-set deadline.

The following indicators provide high-confidence detection with negligible false positive rates:

HTTP GET/POST requests containing kit PHP backend

HTTP response ETag matching kit API response

Static asset unique to kit (Okta template)

GTIG and Okta both provide detailed hardening guidance. The most impactful controls are:

Work Panel equips callers with employee contact data including direct phone numbers, job titles and organizational context sourced through commercial B2B data APIs. Employees should be trained to:

The full IOC set from GTIG contains 76 phishing domains, 11 network infrastructure IPs and associated scripting user-agent strings. Our analysis extends this with the following additional indicators:

Additional domains (not in GTIG IOC table):

Additional infrastructure IPs:

Kit fingerprints (new):

The threat actor tracked as UNC6671 / CORDIAL SPIDER / Falcon has demonstrated sustained operational capability, organizational maturity and rapid infrastructure recovery throughout a 4-month campaign targeting high-value organizations across financial services, legal and technology sectors.

The Work Panel platform first detailed by Okta represents a meaningful evolution in the industrialization of vishing-driven credential theft, packaging target reconnaissance, infrastructure automation and real-time AiTM session management into a single service platform. The separation of duties – callers who know only their next target’s phone number, managers who see the live session queue but nothing else, admins who own the infrastructure – is almost certainly a deliberate organizational design decision that solves the insider risk problem inherent in running criminal operations with hired labor. The Okta report makes this explicit: callers are treated as interchangeable commodity labor, recruited through public underground channels, paid per successful capture and deliberately prevented from accessing the product of their own work.

Despite the new format of these efforts, we observe a continuation of an underlying trend: reduced barriers to entry through increased compartmentalization of efforts. In the same manner by which Ransomware-as-a-Service was made easier through compartmented affiliates, initial access brokers and administrators, we see infrastructure maintenance, targeting and reconnaissance and social engineering execution as distinct functional areas that can be carried out by distinct individuals.

The threat actor’s targeting of MFA-enforced environments without full deployment of phishing resistant MFA is also notable, as victims are generally not technically unsophisticated. Rather, the use of AitM against Okta and M365 targets inconsistent or incomplete deployment of origin-binding cryptography.

The threat actor’s consistent registration patterns, shared infrastructure and reuse of phishing kit assets across the campaign period provide durable detection opportunities that persist despite domain rotation. Organizations in hedge fund, private equity, venture capital and legal sectors, which have featured prominently in the late-campaign targeting wave, should treat this activity as an active and ongoing threat.

[1] Google Threat Intelligence Group. “UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments.” August 6, 2026. https://cloud.google.com/blog/topics/threat-intelligence/unc6671-targets-financial-services-and-enterprise-cloud-environments

[2] Google Threat Intelligence Group. “Welcome to BlackFile: Inside a Vishing Extortion Operation.” May 15, 2026. https://cloud.google.com/blog/topics/threat-intelligence/blackfile-vishing-extortion-operation/

[3] Okta Threat Intelligence. “Behind the Scenes of a Vishing Operation.” July 28, 2026. https://www.okta.com/blog/threat-intelligence/behind-the-scenes-of-a-vishing-operation/

This analysis represents findings as of August 10, 2026. The campaign is active and infrastructure observations may change rapidly. IOC data should be verified against current passive DNS and scan databases before operational use.