Google Warns of 'Vishing' Attacks Targeting Financial Firms with Extortion Demands

Even in an era of AI-driven autonomous cyberattacks, the oldest trick in the book—a convincing phone call—is still getting results. Google's security researchers published a report on Thursday detailing a campaign in which unknown hackers are targeting large financial and investment firms in the U.S., using voice phishing (or "vishing") to steal credentials and sensitive data, which they then use for extortion.

While Google did not name the victims, Reuters reports that the list includes major private equity firms like Apollo Global Management, Bain Capital, Blackstone, Bridgewater Associates, CME Group, KKR, Moody's, and TPG. The hackers, tracked by Google under the umbrella name UNC6671, operate under several distinct brands—Falcon, Helix, Pink, and Redact—which the researchers believe may be a coordinated effort to compartmentalize operations and hide the full scale of their breaches.

The attack chain is surprisingly low-tech. The hackers call employees on their personal cellphones, posing as co-workers or IT helpdesk staff, and trick them into entering credentials and multi-factor authentication codes on spoofed websites. This has proven effective enough to breach organizations that manage billions in assets.

Extortion as a Business Model

The groups run public-facing websites where they threaten to leak stolen data unless a ransom is paid. "The publication of your data is never our preferred resolution; it is the consequence of refusal to engage, deliberate stalling, or failure to honor an agreement," read one such site, framing the extortion as a business negotiation.

Google's researchers note that the hackers have previously targeted manufacturing, real estate, healthcare, insurance, tech, transportation, and hospitality companies, often stealing intellectual property, source code, or sensitive VIP client data. Now they've zeroed in on legal and financial organizations involved in mergers, acquisitions, and litigation—high-value targets where confidential data provides maximum leverage.

What This Means for Developers

For developers and security teams, this campaign is a reminder that no amount of technical defense—firewalls, EDR, or AI-powered detection—can completely neutralize social engineering. The human factor remains the weakest link. Security teams should consider implementing stronger verification protocols for any phone-based requests, such as requiring employees to confirm requests through a separate channel. Additionally, the use of phishing-resistant MFA (like hardware security keys) can mitigate the impact of stolen credentials, even when users are tricked into entering them on spoofed sites.

Google reports that one cryptocurrency wallet linked to the group received around $10 million in bitcoin in the first few months of this year, and ransom demands typically range from $750,000 to $3 million. As these attacks become more organized, the distinction between state-sponsored and criminal hacking continues to blur—making robust security awareness training more critical than ever.