Carmen Estela
Understanding the Threat of Pink Vishing Campaigns
The Pink data extortion group, also known as O-UNC-066 and CL-CRI-1147, has launched a highly sophisticated voice phishing campaign targeting corporate employees using Microsoft 365 and Entra ID environments. This group, active since April 2026, has intensified its operations in July 2026, focusing on critical enterprise sectors such as healthcare, technology, aviation, automotive, construction, and food and beverage industries. By exploiting user unfamiliarity with cryptographic passkeys and leveraging social engineering tactics, Pink operators create realistic phishing schemes that deceive employees into providing login credentials, enabling access to sensitive data.
Preventing and Responding to Vishing Attacks
Organizations must be vigilant against Pink vishing attacks to detect and thwart infiltration attempts. During an attack, employees may encounter a fake Microsoft recovery page requesting cryptocurrency-related information, signaling a compromise. By implementing strict access policies, monitoring passkey registrations, and establishing verification protocols, organizations can mitigate this vulnerability and protect their data from unauthorized access.
About the Author
Carmen Estela, a Cybersecurity Research Analyst at Cyber Defense Magazine, is dedicated to enhancing cybersecurity governance, risk, and compliance standards. With a background in criminology and certifications in data analytics and AI fundamentals, Carmen brings a unique perspective to the cybersecurity industry. Her experience in law enforcement and public service underscores her commitment to combatting cyber threats and promoting best practices in cybersecurity.
Contact Carmen Estela at [email protected]
