UNC6671 — SSO and Okta enrolment root domains on shared registration infrastructure

Targeted identity-provider phishing consistent with UNC6671, the vishing and extortion group behind the BlackFile, Redact, Pink, Helix and Falcon brands. Callers pose as the IT helpdesk and walk employees through an urgent passkey, SSO or MFA enrolment on a look-alike sign-in page, where an adversary-in-the-middle panel relays the password and second factor live. The lure hosts are subdomains named after the targeted organisation under generic root domains. The roots in this row were not named in the published report. They are linked to it by shared registration infrastructure: the same privacy registrar and the same uncommon nameserver set as report-listed roots such as addmypasskey[.]com and myoktasso[.]com, registration dates in the same bursts (for example passkeys-setup[.]com on the same day as addmypasskey[.]com), and the same verb-plus-passkey, SSO or Okta naming. Several also appear on public threat lists under the 0ktapus SSO phishing cluster.