Google exposes hacker groups using fake links to extort US financial firms

Google’s security researchers released a report identifying four hacker groups—Falcon, Helix, Pink and Redact—linked to the broader UNC6671 infrastructure. The groups have been targeting large U.S. financial institutions by sending fraudulent links and conducting vishing calls to trick employees into revealing credentials. After gaining access, the attackers use stolen data to pressure victims with threats of public leaks, demanding ransom payments typically between $750,000 and $3 million.

The report notes that one cryptocurrency wallet associated with the groups received roughly US$10 million in Bitcoin during the early months of 2026. While the primary focus has been on investment and private‑equity firms, the attackers have also pursued companies in manufacturing, real estate, health, insurance, technology, transport and hospitality, seeking intellectual property, software code and strategic client information.