As banks and investment firms move more operations into cloud-based identity platforms, collaboration suites and SaaS ecosystems, attackers are no longer trying to breach the network. They’re logging in.
A campaign update shared Thursday (Aug. 6) by Google’s Threat Intelligence Group showed attackers from the threat actor group UNC6671 had initiated a cyber infiltration campaign targeting companies including Blackstone, Apollo Global Management, Bain Capital, Bridgewater Associates, KKR, TPG, CME Group, Clearlake Capital and Moody’s, as well as hedge funds including Point72, Citadel and Two Sigma.
The attackers built digital traps for more than 200 companies over roughly five weeks. But rather than breaking through security systems, the UNC6671 members called financial services employees on their personal phones, impersonated corporate help desks and persuaded them to surrender access.
The attackers appeared to favor organizations likely to hold information sensitive enough that executives would be willing to pay to prevent its disclosure. It remains unclear which attempted compromises succeeded.
See also: AI Gives Cybersecurity a Backlog CFOs and CISOs Can’t Patch Away
The Next Banking Crisis Could Start at the Help Desk
The resulting threat model being leveled at the financial services space looks less like a ransomware attack and more like identity fraud being executed at enterprise scale.
The group Google tracks as UNC6671 — associated with the former BlackFile extortion operation and newer criminal fronts including Redact, Pink, Helix and Falcon — used employee phone calls to steer employees toward fake login pages designed to capture credentials and multifactor authentication tokens. Once inside, the attackers moved quickly into cloud applications, automate data theft and attempt to suppress the alerts that could expose them.
Attackers are not necessarily defeating multifactor authentication. They are convincing employees to authenticate them. Google described callers posing as IT staff handling urgent security migrations, often contacting employees through personal mobile devices. Victims are directed toward attacker-controlled login portals, where adversary-in-the-middle technology can intercept credentials and authentication tokens. Once a session is established, automated scripts can be used to exfiltrate data from cloud services.
The technique is not particularly sophisticated, but it remains highly effective. That distinction should worry security executives. Banks and investment firms have spent years improving their ability to identify malicious software, suspicious attachments and anomalous network traffic. Those defenses become less decisive when the attacker appears as an authenticated employee using legitimate cloud services.
Sixty-eight percent of financial institutions increased their fraud-detection budgets year over year, according to the 2025 “State of Fraud and Financial Crime in the United States,” a PYMNTS Intelligence report produced in collaboration with Block. That spending comes as 46% of institutions report increasingly sophisticated fraud schemes, up from 35% a year earlier.
See also: Innovation Keeps Expanding Compliance for Mid-Market Firms
The New Cybersecurity Arms Race Is About Trust
As financial companies adopt cloud software, distributed workforces and increasingly interconnected digital platforms, attackers have fewer reasons to fight their way through the traditional network perimeter. A legitimate identity can provide a cleaner route, one where the sophistication lies less in the exploit than in the workflow.
This means that for CISOs, the central security question becomes not whether a credential is valid, but whether the person using it should be trusted at that moment. A legitimate account suddenly enrolling a new MFA device, establishing a session from unusual infrastructure or downloading unusually large volumes of corporate information may require intervention even if every individual action is technically permitted.
“Most firms think AI is an efficiency upgrade, they think they will run the same processes with fewer people. We think that framing is wrong,” Madhu Nadig, co-founder and CTO at Flagright, told PYMNTS. “The firms that will win will rethink both how they apply AI to compliance technology and how they build a team around it.”
Read more: The $100 Million CFO Rewrites the Rules on Legal Spend
The same principle applies to help desk procedures. Requests involving password resets, passkey enrollment or MFA changes increasingly need their own controls: verified outbound callbacks, tightly restricted enrollment processes and separate approval requirements for high-risk users.
And a CFO would rarely tolerate a payment process in which one employee could authorize an unusually large transfer without independent verification. Yet many organizations effectively allow an employee to authorize access to vast stores of corporate information through a single authentication event.
The asymmetry is becoming harder to defend.
For all PYMNTS B2B coverage, subscribe to the daily B2B Newsletter.
