Loading threat actor…
Pink, also tracked as O-UNC-066 and CL-CRI-1147, is a financially motivated cybercrime and extortion actor associated with The Com ecosystem. Since April 2026, the group has conducted voice-phishing operations against enterprise Microsoft 365 environments by impersonating internal IT or security staff and directing employees to fraudulent Microsoft Entra passkey-enrollment pages. The operation abuses user trust in legitimate passkey rollout activity rather than exploiting a software vulnerability. The actor uses a manually operated, panel-controlled phishing kit that supports real-time interaction with victims. The workflow captures usernames and passwords, relays MFA challenges including push approvals, TOTP, and SMS codes, and adapts dynamically to the victim’s authentication flow. During the session, the operator authenticates to the victim’s Microsoft account and covertly registers an attacker-controlled passkey, creating durable access that can persist beyond password resets. The phishing flow also uses fake recovery-key steps to distract victims while the attacker completes passkey enrollment. Following account takeover, Pink has been observed rapidly accessing and stealing data from Microsoft 365 cloud resources including SharePoint and OneDrive, then using the stolen information for extortion. The group operates a leak site under the Pink name and has published stolen data samples while pressuring victims to pay within a short deadline. Reported targeting has focused on organizations in automotive, aviation, construction, food and beverage, healthcare, and technology sectors.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
14 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting vishing-assisted passkey enrollment phishing against Microsoft 365/Entra users to register attacker-controlled passkeys, gain durable account access, steal SharePoint and OneDrive data, and extort victims via a leak site.
Conducting a sophisticated vishing-led phishing campaign to steal Microsoft 365 credentials and enroll attacker-controlled passkeys on victim Microsoft accounts, with the apparent objective of data extortion.
Conducting cross-sector data extortion operations using vishing and phishing kits that impersonate corporate IT and mimic Microsoft 365 passkey enrollment to register attacker-controlled passkeys and take over victim accounts.
Conducting vishing-led phishing campaigns against Microsoft 365 users by calling victims, directing them to fake Microsoft Entra ID login pages, harvesting credentials in real time, and enrolling attacker-controlled passkeys for account takeover and data extortion.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.