Microsoft has tracked passkey- and SSO-themed help desk impersonation since May 2026, with the calls steering employees into adversary-in-the-middle proxies and device-code grants that hand over live Microsoft 365 sessions.
Perspective Coverage
3 publishers
- Builder
- Builder 25%
- Operator
- Operator 63%
- Investor
- Investor 12%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+10
- Incentives35
- Confidence70
GuidePoint says the persona offering to delete stolen data for $20,000 to $60,000 is very likely a ransomware affiliate, which makes the rescue fee a second payment to the same attacker.
Perspective Coverage
3 publishers
- Builder
- Builder 23%
- Operator
- Operator 65%
- Investor
- Investor 12%
Reality
- Evidence66
- Adoption18
- Hype gap+12
- Incentives40
- Confidence62
Arctic Wolf says the cluster it tracks as PREY-0058 deploys no malware at all. A call from fake IT leads to a proxied login page, and the stolen session token comes back from inside the victim's own ASN.
Perspective Coverage
3 publishers
- Builder
- Builder 17%
- Operator
- Operator 75%
- Investor
- Investor 8%
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence60
Apollo's breach letter dates its own delay: four days in, 46 days out
The private equity firm's 21 August notice puts cloud access at 6 to 10 July and the scope finding at 12 August. The interval nobody puts on a dashboard sits in between.
Reality
- Evidence68
- Adoption44
- Hype gap−8
- Incentives66
- Confidence61
The extortion call now comes from your help desk, and the fix is a procedure you own
Google says the BlackFile crew has targeted dozens of organisations by phoning staff and posing as internal IT. No vendor bug is involved, which puts the remedy on IT leadership.
Reality
- Evidence70
- Adoption42
- Hype gap+8
- Incentives62
- Confidence58
UNC6671 did not retire: four brands, one helpdesk script, and calls to personal phones
Google Threat Intelligence Group says the crew behind BlackFile spread into Redact, Pink, Helix and Falcon while keeping the same vishing route into Microsoft 365 and Okta.
Reality
- Evidence60
- Adoption45
- Hype gap+8
- Incentives62
- Confidence55