Google Warns Hackers Are Calling Financial Firm Employees to Steal Data and Extort Victims

Google’s security researchers report that groups of unknown hackers are targeting large financial and investment firms in the United States. The reported goal is to steal sensitive data and extort victims by threatening to publish it. TechCrunch notes that the attacks show older social-engineering tactics remain effective even as AI-powered cyberattacks draw attention.

The hackers are using phone calls to employees’ personal cellphones, pretending to be co-workers or IT helpdesk staffers. According to Google, they try to trick targets into entering credentials and multi-factor authentication codes on spoofed websites. This technique is known as voice phishing, or vishing.

Google dubbed the hacking groups Falcon, Helix, Pink, and Redact. Researchers said the groups may be part of a larger umbrella collective tracked as UNC6671, though it is unclear whether they are affiliates, splinter groups, or users of the same phishing-as-a-service infrastructure. Some groups also run public websites where they threaten to leak stolen data as part of extortion efforts.

Google said the hackers have previously targeted sectors including manufacturing, real estate, healthcare, insurance, technology, transportation, and hospitality. More recently, the activity has focused on legal and financial organizations, including private equity firms. Google researchers wrote that targeting organizations involved in mergers, acquisitions, capital deployment, and litigation may be a strategy to obtain high-value confidential data and increase leverage in extortion demands.

The report is a reminder that employee phone calls can be a high-risk entry point, especially when attackers combine urgency, impersonation, spoofed login pages, and requests for multi-factor codes. Financial firms should treat unexpected IT or coworker calls as verification events, not routine support. The clearest action is to reinforce out-of-band verification, tighten credential and MFA workflows, and train staff to identify vishing attempts before credentials are entered.