aiqbench analysis
This article details a sophisticated cyber campaign where UNC6671 leverages voice phishing (vishing) and session hijacking techniques to automate credential theft within Microsoft 365 environments without requiring password cracking. While the attack vector involves social engineering, the core technical focus is on how attackers exploit authentication tokens and cloud infrastructure to exfiltrate sensitive corporate data from targeted sectors like financial services.
UNC6671 Automates Microsoft 365 Data Theft After Hijacking Employee Sessions
UNC6671 is carrying out data theft campaigns that begin with a phone call. The group poses as an IT helpdesk, claiming an urgent security migration is necessary. A convincing call and a fake sign-in page can turn an ordinary session into an entry point. The calls create urgency before employees can verify the request independently. […] The post UNC6671 Automates Microsoft 365 Data Theft After Hijacking Employee Sessions appeared first on Cyber Security News.
UNC6671 is carrying out data theft campaigns that begin with a phone call. The group poses as an IT helpdesk, claiming an urgent security migration is necessary. A convincing call and a fake sign-in page can turn an ordinary session into an entry point. The calls create urgency before employees can verify the request independently. The campaign is dangerous because it does not need to crack a password. It captures credentials and a live authentication token. That token lets…
Excerpt shown under the publisher's RSS terms · 79 words · full text and figures are on the publisher's site
Related coverage
Weekly Cybersecurity Newsletter Bulletin – Microsoft 0-day, FortiOS, PAN-OS Flaw, Revolut Data Breach, and 20+ Stories
Cybersecurity News · Sep 14, 2026
Hackers Use Passkey-Themed Phishing to Hijack Microsoft 365 Accounts and Steal Cloud Data
Cybersecurity News · Sep 10, 2026
Weekly Cyber Security Newsletter– Claude Hacked 3 Companies, Cisco 0-Day, Word Copilot and VMware Flaw +20 Stories
Cybersecurity News · Aug 2, 2026
GhostCode Phishing Kit Bypasses Microsoft 365 MFA to Hijack Accounts in 78 Seconds
Cybersecurity News · Sep 16, 2026