CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

BlackFile extortion group escalates vishing campaigns with identity theft and data theft targeting retail and hospitality sectors

First reported
Last updated
2 unique sources, 2 articles

Summary

Hide ▲

Since February 2026, the BlackFile extortion group (aliases: CL-CRI-1116, UNC6671, Cordial Spider) has conducted sustained vishing-driven credential theft and data exfiltration campaigns against retail and hospitality organizations. The group impersonates IT helpdesk staff using spoofed VoIP numbers and fraudulent Caller ID Names, often combined with antidetect browsers and residential proxies to avoid detection. Stolen credentials are used to register attacker-controlled devices and bypass MFA, enabling escalation to executive accounts via internal directory scraping. Data is exfiltrated through legitimate Salesforce and SharePoint API functions and web interfaces, targeting files containing terms such as 'confidential' and 'SSN'. Extortion demands, typically seven-figure sums, are delivered via compromised employee email accounts or randomly generated Gmail addresses, with additional harassment including swatting attempts against executives. Security researchers from Unit 42 and RH-ISAC have linked BlackFile to the activity cluster CL-CRI-1116 and noted overlaps with the loosely affiliated collective 'The Com'.

Timeline

  1. 24.04.2026 21:26 2 articles · 3d ago

    BlackFile escalation: vishing-driven credential theft and API-based data exfiltration in retail and hospitality sectors

    Palo Alto Networks’ Unit 42 and the Retail and Hospitality Information Security and Analysis Center (RH-ISAC) jointly published a report on April 23, 2026, detailing the BlackFile cluster CL-CRI-1116’s tactics. The report confirms overlap with public reporting on BlackFile, UNC6671, and Cordial Spider, and links the activity to the collective 'The Com'. The report adds technical detail on the group’s vishing infrastructure, including the use of antidetect browsers and residential proxies to mask geographic locations and bypass IP-based reputation filters. It also describes SaaS data discovery and API abuse for exfiltrating large volumes of data—including CSV datasets of employee phone numbers and confidential business reports—via legitimate Salesforce API access and SharePoint download functions. Extortion demands are noted to typically be seven-figure sums, delivered via random Gmail addresses or compromised employee email accounts. Security recommendations emphasize managing identity verification for callers, restricting information shared in calls, and limiting IT support actions per call without escalation to mitigate these tactics.

    Show sources
    Open in new tab

Information Snippets

Similar Happenings

Telephone-Oriented Attack Delivery (TOAD) Bypasses Secure Email Gateways

Telephone-Oriented Attack Delivery (TOAD) emails, which contain only a phone number as the payload, are bypassing secure email gateways and becoming a significant threat. These attacks, which accounted for nearly 28% of gateway-bypassing detections, exploit the simplicity of a phone number to evade detection and manipulate victims into revealing sensitive information or granting remote access. The attacks are particularly effective due to their ability to blend in with legitimate business communications and the increasing sophistication of evasion tactics.

Open in new tab

Optimizely Data Breach After Vishing Attack

An ongoing wave of vishing-led breaches attributed to ShinyHunters has claimed a new victim: Aura, a digital safety firm. The attack exposed contact details of nearly 900,000 individuals, stemming from a marketing tool inherited in a 2021 acquisition. ShinyHunters claimed the theft of 12GB of files containing PII and corporate data, releasing it after failed extortion attempts. The company emphasized no SSNs, passwords, or financial data were compromised and is conducting an internal review with law enforcement involvement. Earlier in February, Optimizely disclosed a similar breach following a voice phishing attack that compromised basic business contact information. Both incidents underscore the continued exploitation of vishing tactics by ShinyHunters to gain initial access to organizations, with impacts focused on contact data rather than deeper system compromise.

Open in new tab

Figure Fintech Breach Exposes 967,200 Accounts via Social Engineering

Figure Technology Solutions, a blockchain-based fintech firm, suffered a data breach affecting nearly 1 million accounts. Hackers stole personal and contact information through a social engineering attack. The breach was attributed to the ShinyHunters extortion group, which leaked 2.5GB of data from loan applicants. The attackers impersonated IT support to trick employees into providing access to SSO accounts, gaining entry to various enterprise applications.

Open in new tab

Increased Social Engineering Attacks Targeting MFA and Help Desks

Threat actors, including groups like Scattered Spider, are increasingly using social engineering tactics to bypass multi-factor authentication (MFA) and gain unauthorized access to enterprise networks. These attacks often target help desk personnel, exploiting human vulnerabilities to reset passwords or override MFA. The FBI and CISA have issued alerts about the growing threat of such high-touch social engineering campaigns. The attack on Clorox by Scattered Spider resulted in approximately $380 million in damages, including $49 million in remedial costs and hundreds of millions in business-interruption losses. The attackers exploited the service desk run by Cognizant, repeatedly phoning to obtain password and MFA resets without meaningful verification. This incident highlights the need for robust caller verification and stringent security protocols in help desk operations. Organizations must rethink their help desk operations, focusing on training, validation processes, and a security-first culture. Frontline staff need to recognize red flags and escalate suspicious requests. Executives and senior leaders should model verification behavior, reinforcing that diligence is expected throughout the organization. Effective defense against these attacks requires ongoing training, relevant simulations, and a culture that prioritizes security over speed. Help desk and security teams must collaborate closely to identify and mitigate potential threats.

Open in new tab