Hackers Use Phone Scams to Target Wall Street Firms

A group of hackers known as UNC6671 is shifting its focus toward high value financial targets. New data from Google shows that these actors are using voice phishing, or vishing, to target staff at top private equity and law firms. By posing as IT support workers, they trick employees into entering passwords and multi factor authentication codes into fake websites.

Once the hackers gain access, they use automated scripts to steal sensitive data from cloud services. While early attacks focused on technology and travel companies, the group began targeting major financial institutions during the summer. Reports identify several firms, including Blackstone, KKR, and Moody’s, as potential targets of these phishing efforts.

This trend serves as a warning that even the biggest financial players remain vulnerable to human error. Despite millions spent on complex security software, attackers are finding that a convincing phone call can easily bypass sophisticated digital defenses. Firms now face the challenge of updating training to ensure employees can spot these deceptive tactics before a breach happens.