Pink is a newly identified extortion group (cluster CL-CRI-1147) employing social engineering techniques including voice phishing (vishing) and fake IT helpdesk impersonation to compromise organizations. The group steals employee credentials and successfully bypasses multi-factor authentication controls. Using these credentials, Pink exfiltrates sensitive data from cloud storage services such as SharePoint and OneDrive. They then threaten victims with data leaks unless ransom demands are paid within a 72-hour deadline. The group operates a data-leak site launched on May 31, 2026, and is linked to The Com, a loosely connected network of English-speaking hackers and extortionists. Attackers also use compromised victim accounts and internal Microsoft Teams messages to communicate extortion demands. The campaign reuses domains and IP addresses across multiple victims, indicating a coordinated infrastructure.

The campaign results in credential theft, multi-factor authentication bypass, unauthorized access to cloud storage data, and extortion through threats of data leakage. Organizations face potential data breaches, financial loss from ransom payments, and reputational damage. The use of compromised internal accounts and communication platforms like Teams increases the difficulty of detection and response.

No official patch or fix applies as this is a social engineering campaign rather than a software vulnerability. Organizations should enhance user awareness training focused on vishing and helpdesk impersonation tactics. Implement strict verification procedures for helpdesk calls and credential requests. Monitor for suspicious internal communications and unusual access to cloud storage. Employ strong anomaly detection on account activities. Since the threat involves MFA bypass via social engineering, consider additional authentication safeguards and incident response readiness. The vendor advisory does not indicate 'no action required' or existing mitigation; therefore, proactive user education and verification controls are recommended.