Pink Extortion Gang Uses Fake Helpdesk Calls to Steal Credentials

Pink uses vishing and IT impersonation to phish credentials and bypass multi-factor authentication. The gang exfiltrates enterprise cloud storage and productivity data to extort victims. Its data-leak site launched on May 31 and is tracked as cluster CL-CRI-1147. Unit 42 links Pink to The Com, a network of English-speaking hackers and extortionists.