{
  "name": "Latest goon squad to use fake helpdesk calls to steal creds",
  "slug": "latest-goon-squad-to-use-fake-helpdesk-calls-to-steal-creds",
  "description": "A new extortion group called Pink, tracked as cluster CL-CRI-1147, employs voice phishing and fake IT helpdesk impersonation to compromise organizations. The gang steals employee credentials, bypasses multi-factor authentication, and exfiltrates data from cloud storage platforms like SharePoint and OneDrive. Pink threatens to leak stolen information unless ransom demands are met, setting 72-hour deadlines. The group's data-leak site launched on May 31, 2026. This approach mirrors tactics popularized by Lapsus$, Scattered Spider, and ShinyHunters. Incident responders link Pink to The Com, a loosely connected network of English-speaking hackers and extortionists. Attackers use compromised victim accounts and internal Teams messages for extortion communications, reusing domains across multiple targets.",
  "published": "2026-06-04T20:52:18+00:00",
  "created_at": "2026-06-04T20:52:18+00:00",
  "modified_at": "2026-06-05T04:41:48+00:00",
  "created_at_opencti": "2026-06-04T20:52:18+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2026-06-04",
    "cloud data theft",
    "credential phishing",
    "extortion",
    "helpdesk impersonation",
    "mfa bypass",
    "social engineering",
    "the com",
    "vishing"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "96.232.20.66"
      },
      {
        "id": "",
        "name": "185.178.208.153"
      }
    ],
    "intrusion_sets": [
      {
        "id": "1256e2d1-a991-4605-ae87-da93e31ec166",
        "name": "Pink",
        "slug": "pink"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "passkeyadd.com"
      },
      {
        "id": "",
        "name": "passkeydeploy.com"
      },
      {
        "id": "",
        "name": "deploypasskey.com"
      }
    ]
  },
  "external_refs": [
    "https://www.theregister.com/cyber-crime/2026/06/04/pink-is-the-latest-goon-squad-to-use-fake-helpdesk-calls-to-steal-creds/5251434",
    "https://otx.alienvault.com/pulse/6a2201a2fe176ac0486f58e5"
  ]
}