Google Reports Phone-Based Hacking Campaign Against US Financial Firms; Reuters Data Names Blackstone, KKR Among Targets
The Facts
- Google said in a blog post published Thursday that it is tracking hacking activity against large US financial and investment firms carried out by groups it identifies as Falcon, Helix, Pink and Redact.
- The attackers phone employees, presenting themselves as colleagues or internal IT/help-desk staff, and direct them to fraudulent websites where victims enter passwords and multi-factor authentication codes.
- Reuters, reviewing Google findings and internet intelligence data, reported that the fake credential-harvesting websites were tailored to firms including Blackstone, Bridgewater Associates, Apollo Global Management, Bain Capital, KKR, TPG, CME Group, Clearlake Capital and Moody's.
- Dozens of prominent US financial institutions and other businesses were targeted over the past month, according to the data reviewed by Reuters.
- The stated objective of the intrusions is to steal sensitive corporate data and then extort the victims by threatening to publish it.
- Google said some companies, which it did not name, paid ransoms to the hackers.
- Google did not identify any victims by name, declined to comment on Reuters' findings, and Reuters said it could not determine which companies were actually compromised.
- The campaign relies on social engineering of employees rather than advanced malware, which researchers cite as evidence that the human element remains a persistent weak point in corporate security.
Context
How does this type of attack work in practice?
The technique is voice phishing, or "vishing." Attackers call employees — in some cases on personal phones — and claim to be co-workers or internal IT support, then instruct the target to update credentials on a website built to imitate the employer's login page Bluewin.ch,Digit. Because victims also enter multi-factor authentication codes, the attackers can take over accounts and move into corporate networks Bluewin.ch,Times of India.
Does Google link the four named groups to a single operation?
Google's Threat Intelligence Group said it continues to track an actor it designates UNC6671 conducting compromises that lead to data-theft extortion, and that despite the alleged retirement of the BlackFile extortion brand in May 2026, telemetry and infrastructure analysis indicate the actor has instead spread its activity across multiple extortion fronts including Redact, Pink, Helix and Falcon Times of India.
How large is the campaign, and what remains unknown?
Coverage of the Reuters findings describes dozens of prominent US financial institutions and other businesses being targeted over roughly the past month, with one report characterizing the campaign as reaching more than 200 companies over five weeks Reuters,InfoMoney. What is not established publicly is which of the named firms were actually breached, what data may have been taken, or which companies paid — Google withheld victim names and Reuters said it could not identify the compromised organizations NDTV,iTnews.
Where Left and Right agree, and where they split
- Where Left and Right agree
- The break-in required no exotic malware — just a phone call and an employee at a fake login page — and both reads treat the quiet ransom payments as a real failure.
- Where Left and Right split
- Whether the story is about the people whose data sits in those systems being kept in the dark, or about firms bankrolling the next phone call by paying.
How left and right read it
Dozens of prominent US financial institutions were targeted in a single month, and the break-in tool was a phone call — someone posing as help-desk staff, walking an employee onto a fake login page. No advanced malware required. Firms this large hold enormous amounts of sensitive data, yet no victims are named, some quietly paid ransoms, and no one can say who was actually compromised; the people whose information sits inside those systems deserve to know more than the attackers already do.
“Despite the prevalence of advanced security programs and AI-driven threats, these older, more direct methods remain remarkably effective.” — The Independent
Hackers phoned employees at large US financial firms, posed as internal IT, and walked them onto fake login pages where passwords and multi-factor codes were handed over. No exotic malware — just people — and Google says some firms paid. Every ransom paid prices the next phone call as worth making; institutions with these resources should be hardening their own workforce and refusing to bankroll the trade.
The receipts — all 34 sources
Wire services (6)
Independent coverage (28)
Facts first. Then every angle.
The day’s biggest stories in one short brief — the facts everyone agrees on, then the competing values behind the headlines. Free in your inbox.