Google says hackers are calling financial firm employees to hack and extort victims

Coordinated hacking groups are successfully targeting financial and investment firms through voice phishing—calling employees on personal devices while impersonating IT staff to steal credentials and sensitive data for extortion purposes. This campaign, tracked by Google across four identified groups (Falcon, Helix, Pink, and Redact) potentially operating under the umbrella UNC6671, has extracted approximately $10 million in cryptocurrency and demonstrates that basic social engineering remains highly effective against even sophisticated organizations, posing significant data breach and financial risk to enterprises across multiple sectors. For IT organizations, this highlights a critical vulnerability in employee authentication processes and the need for security controls that extend beyond traditional perimeter defenses to protect against targeted human-centric attacks.