UNC6671 — passkey and SSO phishing root domains from the GTIG report (7/9)

Targeted identity-provider phishing attributed in public reporting to UNC6671, the vishing and extortion group behind the BlackFile, Redact, Pink, Helix and Falcon brands. Callers pose as the IT helpdesk, often phoning employees on personal mobiles, and walk them through an urgent passkey or MFA enrolment on a look-alike sign-in page. An adversary-in-the-middle panel relays the password and second factor live, including push approvals, number matching and SMS codes, and the stolen session is then used to pull data from Microsoft 365, Okta and other SaaS tenants. The lure hosts are subdomains named after the targeted organisation under generic root domains that pair a verb with "passkey", "sso", "mfa" or "okta" (for example registerpasskey[.]com, oskeysync[.]com, portalsetuphub[.]com). This row covers root domains published by Google Threat Intelligence Group.