UNC6671 / 0ktapus — SSO, MFA and passkey phishing domains (October 2026 wave)

Targeted identity-provider phishing attributed in public reporting to UNC6671, the vishing and extortion group behind the BlackFile, Redact, Pink, Helix and Falcon brands, and listed by public threat lists under the 0ktapus cluster. Callers pose as the IT helpdesk and walk employees through an urgent SSO, passkey or MFA enrolment on a look-alike Okta or Microsoft sign-in page, where an adversary-in-the-middle panel relays the password and second factor to the real provider in real time. The lure host is a subdomain named after the targeted organisation; the sign-in page stays blank behind a spinner until the operator approves the session, so it screens automated visitors. This row adds the October 2026 root domains, which follow the group's identity/MFA naming pattern and are registered through one registrar with managed DNS.