Threats Tagged 'cloud data theft'

The Pink extortion group uses voice phishing and fake IT helpdesk impersonation to steal employee credentials, bypass multi-factor authentication, and exfiltrate data from cloud storage platforms such as SharePoint and OneDrive. They threaten to leak stolen data within 72 hours unless ransom demands are met. This campaign, active since May 31, 2026, leverages compromised accounts and internal Teams messages for extortion communications and reuses domains across multiple targets. Pink is linked to The Com, a network of English-speaking hackers and extortionists. The tactics resemble those used by groups like Lapsus$, Scattered Spider, and ShinyHunters.