SOCRadar® Cyber Intelligence Inc. | New Data Extortion Group “Pink” Goes Big Game Hunting With Evasive Phishing Kits

Jun 12, 2026

18 Mins Read

New Data Extortion Group “Pink” Goes Big Game Hunting With Evasive Phishing Kits

Pink Data Extortion Group is emerging as one of the latest examples of how voice phishing and data extortion continue to shape the threat landscape. Instead of relying on noisy encryption-based ransomware, the group appears to follow a faster and stealthier credential-driven model built around vishing, evasive phishing kits, and targeted attacks against high-value organizations.

SOCRadar Threat Research Unit analyzed Pink’s campaign activity, phishing infrastructure, victimology, and technical playbook. The findings show a group focused on Big Game Hunting, using tailored Okta and Microsoft Entra ID phishing kits, backend-controlled access gates, and social engineering workflows designed to bypass MFA and even manipulate passkey enrollment.

Key Points

Pink is a newly tracked group, which leverages voice phishing to impersonate IT personnel and capture credentials for subsequent data exfiltration.
The actor is highly likely Com-affiliated (an international English-speaking multi cybercriminal network) and based on infrastructure and technique overlap, Pink is likely considered a rebrand of BlackFile/Redacted group.
Their attack playbook was operational as of early March 2026 and continues to be active as of the time of reporting, whereas their DLS went live on May 31, 2026.
Their phishing kits target both Okta and Entra ID environments, include extreme vetting from sandboxes and researchers, real-time verification for the kits’ visibility and the capability to social engineer for passkey registrations and recovery words.
Pink utilises Cloudflare and DDoS-Guard for hosting and Tucows and Nicenic for domain registration, with their target’s name registered as a subdomain.
Their targeting strategy suggests Big Game Hunting with multiple high-net-worth United States ecosystems, especially around Healthcare, Technology, and Financial Services.

Who is “Pink”?

Voice phishing and data extortion are persistent trends in 2026. Multiple groups emerged performing data extortion attacks rather than relying on data encryption (i.e. Silent Ransom Group, ShinyHunters and BlackFile) since they do the same amount of damage easier and stealthier than encrypting a network. Threat actors increasingly perform social engineering attacks, especially through voice phishing (vishing) to lure targets to perform actions such as providing their credentials and Multi-Factor Authentication (MFA) details or giving them Remote Monitoring and Management (RMM) tool access.

Pink, also tracked as CL-CRI-1147, is a newly established data extortion group that relies on social engineering to acquire initial access. The group leverages vishing, impersonating the internal IT support of their targets, luring them into providing their credentials and authentication information on their phishing site. Upon gaining a foothold, the group collects and exfiltrates data from SharePoint and OneDrive, then distributes extortion demands via compromised emails and internal Teams messages. On extortion, they provide their victims with a qTox ID, a Data Leak Site (DLS) associated with the Pink brand, and a 72-hour deadline for communication. Pink’s DLS went live on May 31, 2026 and already lists multiple victims and claims no association with prior groups.

The group is also likely considered a Com-affiliated actor since their techniques are very similar with other Com-affiliated groups like Shinyhunters, Scattered Spider and BlackFile/Redact. “The Com” (short for “The Community”) is a decentralized global cybercriminal subculture, primarily made up of English-speaking youths and young adults aged 11 to 25. Operating primarily on mainstream platforms like Discord, Telegram, and gaming servers, the network is known for cyberattacks, extortion, and extreme real-world violence. According to Google Threat Intelligence Group (GTIG), the group is assessed to be a rebrand of Redact (a previous rebrand of BlackFile).

Pink’s DLS Site (Unit42)

Pink’s DLS Site (Unit42)

Campaign Analysis

As stated before, Pink starts calling employees impersonating their IT personnel, luring them to access a specifically crafted personalized phishing page and provide their authentication information for subsequent data extortion. Their campaign has been active since at least early March 2026, is still active as of the time of reporting, includes extreme vetting on their phishing kits and their infrastructure provides insights into their targeting strategy (mostly notably healthcare, biotech, technology and financial sectors across the US).

Pink’s Attack Playbook

Phishing Kits

During our analysis two phishing kits were identified as being employed by the threat actor, targeting both Microsoft Entra ID, and Okta environments. The kits share multiple similarities with the Doko panel used by ShinyHunters and BlackFile.

Phishing Kit 1: Microsoft Entra ID Live-Panel Kit

Pink’s Entra ID Phishing Kit Flow

Phase 1: The Evasion Gate and Human Verification

The first kit uses heavy evasion tactics to thwart security researchers and automated scanners. Before a single pixel of the phishing lure is rendered to the target, the entire payload is gated behind an extensive environmental check script.

Technique	Description
Hardware / VM Fingerprinting	Uses WebGL to check the unmasked vendor and renderer for virtualized environments (e.g., swiftshader, llvmpipe, virtualbox, vmware).
Headless Browser Detection	Checks for navigator.webdriver, missing window.chrome in Chrome, and legacy automation artifacts like window._phantom or document.__selenium_unwrapped.
Environmental Anomalies	Blocks execution if the screen resolution is explicitly 800×600, less than 300×300, or if the timezone is set to UTC.
Network / ASN Filtering	Performs an asynchronous fetch to ipapi.co to check the visitor’s ASN. Automatically blacklists major cloud providers, datacenters, VPNs, and proxies.

Even if these automated checks pass, the content still does not load. The kit waits for passive human interaction (mouse movement, touch, click, or scroll) to neutralize passive URL scanners.

Once interaction is detected, it unhides the initial application container and injects invisible honeypot fields (website_url) into forms. If a bot fills out this hidden field, it is instantly redirected to Wikipedia.

Excerpt of Detection Mechanisms

Phase 2: Heartbeat and Access Control

Passing the client-side checks only gets the target to the “Gate” (/auth_61858/gate/). Visually, this renders as a benign Microsoft-style loading spinner. The true phishing content remains hidden because the kit requires explicit authorization from the attacker’s backend.

At this stage, the client establishes a C2 heartbeat, polling backend.php every second. This persistent connection sends telemetry (OS, browser, IP, country) to the attacker. The kit sits on the loading screen indefinitely until the backend responds (manually or in an automated way defined by the backend):

Server-Side Blocking: If the backend evaluates the telemetry and identifies a sandbox or researcher, it returns {“blocked”: true}. The kit immediately clears the heartbeat and redirects the user to a dead IP (http://192.0.2.1/).
Commanding the Next Route: If the target is accepted, the backend returns a JSON command array instructing the kit to redirect the user to the first actual phishing page.

Excerpt of Heartbeating

Phase 3: Dynamic Single Page Application (SPA) Routing and Branding

Once authorized by the backend, the kit shifts into its active credential-harvesting Microsoft 365 phase. Built entirely as a JavaScript-driven SPA, it avoids navigating the target through multiple PHP pages. Instead, it intercepts form submissions and uses history.pushState() to swap out HTML templates based on the current step of the attack (e.g., from /identify/ to /password/).

To increase trust, the kit fetches dynamic branding via an API (backend.php?action=get_branding). This allows the kit to instantly adapt its visual lures, such as logos and background images, to match the target organization’s actual Entra ID tenant.

Excerpt of Branding

Phase 4: Advanced Subversion (MFA & Passkeys)

The most alarming capability of this kit is its built-in workflows designed to defeat modern authentication standards. Because the attacker operates a real-time C2 connection, they can dynamically push the target to specific modules based on what the authentic Microsoft login prompt requires.

Authenticator Number Matching: To defeat push-based MFA, the kit features an “Approve sign in request” template. The backend dynamically injects the auth_code (e.g., a two-digit number) for the target to type into their mobile device, bridging the gap between the attacker’s proxy and the target’s phone.
Passkey Subversion: Passkeys (FIDO2/WebAuthn) are notoriously resistant to adversary-in-the-middle (AiTM) attacks. To overcome this defense layer, the kit likely resorts to targeted social engineering. It attempts to trick targets into surrendering their passkey recovery words (via the /passkey/check/ route) or instructs them to register an attacker-controlled passkey on their device. While these frontend templates mention about passkey actions, we do not have the backend code required to see exactly how they are proxying the WebAuthn API calls, or if this relies purely on social engineering.

Excerpt of Passkey Frontend Templates

Phase 5: The “Success” Lure

When the target has successfully provided all requested authentication information, the backend sends a final redirect command to move the victim to the /auth_61858/done/ route. Rather than redirecting the victim to the real application (which might trigger secondary login prompts or errors) the kit renders a final, placating message:

“Your account now meets organization requirements” > Your account has been verified and now meets your organization’s security requirements. No further action is needed. You can safely close this page.

A “success” message tied to a plausible corporate IT compliance pretext, ensures the victim feels a sense of completion without alerting their IT or Security department, buying the attackers critical time to utilize their access.

Phishing Kit 2: Gated Okta Impersonation Kit

Pink’s Okta Phishing Kit Flow

We identified a second kit with striking architectural similarities to the Entra ID version, specifically tailored for Okta environments. Like the previous kit, this is not a static credential harvester. It is a dynamic, operator-controlled SPA that heavily relies on backend C2 to authorize the attack and exfiltrate credentials.

By analyzing the client-side JavaScript and HTML structure, we can map a similar sequence of events a target experiences when landing on this page.

Phase 1: Tracking & C2 Initialization

A script named client.jsisloaded early in the <head> of the DOM and it is responsible for a variety of tasks:

Generating and globally exposing key components that the subsequent scripts rely upon:
- window.__token: The target’s unique session ID.
- window.__windowId: The ID distinguishing the specific browser tab.
- window.getToken: The function used to retrieve the session ID.
- window.getWindowId: The function used to retrieve the tab ID.
Through the hostKey() function, scoping identifiers to the hostname (t:phishing_domain.com). This hints the same kit can be deployed across multiple hostnames simultaneously without session data from separate phishing campaigns conflicting.
Generating a unique UUID (Token) and redundant Window IDs, and intentionally storing them in multiple browser databases with fallbacks. If an ID isn’t found in sessionStorage (scoped to the tab), it checks localStorage (persistent across tab closures and browser restarts). If it has to generate a new ID, it writes it to both locations immediately.
As a third layer of persistence, immediately writing these identifiers to three separate cookies (token, okta_token, and window_id) with 24-hour expiration.
Initiating two separate communication loops with the backend (/api_FyekIDWY.php):
- Heartbeat: Executes hb() immediately and then every 5 seconds (setInterval(hb, 5000)). This loop pushes passive JSON telemetry to the operator: “Token X is alive on tab Y on page Z.”
- Redirect Command: A second, independent loop of function cr() starts after a 2-second delay: setTimeout(cr, 2000) and performs a distinct GET request looking for the specific command: if (d && d.redirect). Crucially, within this channel, if the operator realizes the target needs to skip the current form or jump directly to a new harvesting stage they can ignore the gate approval (described next) and instead push a response to the client.jsloop: i.e. {“redirect”: “/sign-in/password/”}. The cr() function intercepts this and instantly forces the browser to the new page, bypassing the current visual logic entirely.

Content of client.js

Phase 2: The Preload & The “Bot Gate” Lockdown

Upon initial load, the kit aggressively preloads Okta-specific fonts, stylesheets (okta-sign-in.min.css), and icons. However, the DOM is immediately locked down by a script that injects a full-screen overlay (#rp-bot-gate) containing a loading spinner.

The HTML document is appended with a class (rp-gate-locked) that disables scrolling and interaction. The target sees nothing but a white screen with a spinning wheel. Both kits refuse to show the phishing lure until a backend server explicitly authorizes the session. This proves that threat actors are actively filtering incoming traffic to drop automated scanners, sandboxes, and security researchers. In contrast to the Entra ID kit, this one is surprisingly “quiet” on the client side, without any visitor fingerprinting mechanisms. This might suggest that the threat actors are doing their analysis server-side to hide their detection logic from researchers.

Excerpt of Gating Mechanism

Phase 3: The Heartbeat and Operator Approval

While the target is staring at the spinner, the kit initiates a polling sequence. It calls the poll() function, which acts as a heartbeat, sending a payload containing a session token and window ID to the backend C2 script at /api_FyekIDWY.php.

The kit will remain locked until the backend responds with a specific JSON payload: {“approved”: true}.

If approved: The hide() function executes, destroying the spinner and revealing the Okta login lure.
If denied (or pending): The show() function keeps the gate locked, polling every 1.5 to 4 seconds.

Excerpt of HeartBeat & Operator Approval

Phase 4: The Okta Deception Interface

Once authorized, the target is presented with a pixel-perfect replica of the Okta login interface. The kit includes a custom app banner reading “Sign in with your account to access Okta Dashboard” to establish trust.

The credential harvesting is split into stages (Username, then Password). When the target enters their username and clicks “Next”, the handler(e) JavaScript function intercepts the submission, preventing the browser from actually submitting the form.

Excerpt of handler() Function

Phase 5: Exfiltration via Beacon API

Instead of a traditional form post, the kit uses a highly effective persistence technique for exfiltration: navigator.sendBeacon(‘/j.php’, …). The Beacon API is designed to send analytics data asynchronously to a web server even if the user immediately closes the tab or navigates away. If sendBeacon fails, it falls back to a standard synchronous XMLHttpRequest. After the data is sent, the victim is redirected to the next stage (/sign-in/password/ or /sign-in/processing/).

Excerpt of Exfiltration via the Beacon API

Infrastructure

The actors primarily hosted their phishing kits on Cloudflare and DDoS-Guard. As part of domain registrations, they heavily relied on Tucows and Nicenic.Their operational playbook included registering subdomains with their targets’ brand name. The following naming convention was followed by the threat actors:

{target_brand}.{keyword}passkey.com OR {target_brand}.passkey{keyword}.com

This structure allowed us to expand and identify more of their infrastructure through searching for lookalike domains with this specific pattern through Validin. For additional validation we also checked for each domain their subdomains (if they include brand names), as well as to search them in scanners like URLScan, to check if they contain the phishing kits in the page’s DOM. Domains are included in the Indicators of Compromise section.

URLScan Search to Identify Further Domains

URLScan Search to Identify Further Domains

Targeting

By analyzing the subdomains of their infrastructure we could get insights into their targeting strategy. Targeting assessments are based on observed lure infrastructure and should not be interpreted as confirmed victimization. Based on automated analysis to map the targeted entities, the actors seem to likely favor industries that handle sensitive user data, financial transactions, or major corporate infrastructure. Healthcare, Technology, and Financial Services combine to make up over two thirds of all targeted entities.

Sector	Count	Percentage	Core Targets Included
Healthcare & Biotech	20	26.7%	Vertex, IDEXX, Stryker, Dexcom, Hologic, Astellas
Technology / SaaS	16	21.3%	IBM, Workday, HubSpot, Blackbaud, Uber, Teradata
Financial Services	16	21.3%	BlackRock, Cboe, Nuveen, Apollo, FinTech/Venture Capital (a16z, Bessemer)
Professional Services	7	9.3%	Baker Botts, Sullivan & Cromwell, Verisk, Circana
Media & Entertainment	6	8.0%	Fox Corp, Disney, MSG Entertainment
Construction / Infrastructure / Real Estate	5	6.7%	Swinerton, Walsh Group, Kilroy Realty, MasTec
Aviation / Logistics / Transportation	3	4.0%	SkyWest Airlines, XPO Logistics, ITS Logistics
Consumer Retail / Energy / Food	2	2.7%	Skechers, Chipotle, Expand Energy

Distribution of Pink Targets Per Sector

By evaluating the geographic footprint of the targeted entities it becomes clear that these campaigns are overwhelmingly focused on United States corporations, with intentional outliers in Europe and Asia.

North America (United States): 69 subdomains (92.0%) The massive majority of companies targeted are based in the US, strongly leaning toward Silicon Valley tech icons, Wall Street investment firms, and major US hospital/medical supplier networks.
Global / Multiregional (Outside US): 6 subdomains (8.0%)
- Europe (UK / Ireland): 5 subdomains targeting brands like PLMR (UK-based PR/Lobbying) and Perrigo (American pharmaceutical company but legally registered in Ireland).
- Asia (Japan): 1 subdomain targeting Astellas Pharma (Tokyo-headquartered multinational).

Conclusion

The Pink group represents a dangerous evolution in the data extortion landscape, emerging as a Com-affiliated threat actor that likely serves as a rebrand of the BlackFile and Redact groups. By combining vishing-driven social engineering with gated phishing infrastructure, they have demonstrated their intent to subvert modern security measures, including MFA and passkey authentication. Their clinical focus on high-value US sectors (most notably Healthcare, Finance, and Technology) presents a strategic approach to Big Game Hunting.

Organizations should prioritize security awareness training focused on vishing, as employees are the primary entry point. Additionally, shifting away from push-based MFA toward hardware-backed FIDO2/WebAuthn authentication can significantly reduce the risks of Adversary-In-The-Middle kits. While Pink’s Entra ID kit attempts to subvert passkeys through social engineering, true FIDO2/WebAuthn remains the gold standard. Security teams should also implement monitoring for anomalous login patterns and suspicious authentication registrations to detect potential compromises early.

MITRE ATT&CK TTPs

Tactic	Technique ID	Technique Name	Description
Reconnaissance	T1591	Gather Victim Org Information	Pink analyzes organizational structures, identifies key employees, and gathers contact details like phone numbers.
Resource Development	T1583.001	Acquire Infrastructure: Domains	Pink registers deceptive domains using registrars like Tucows and Nicenic.
Resource Development	T1587	Develop Capabilities	Pink develops phishing kits with built-in evasion mechanisms to target M365 and Okta environments.
Initial Access	T1566.002	Phishing: Spearphishing Link	Pink sends deceptive links to personalized phishing pages via social engineering.
Initial Access	T1566.004	Phishing: Spearphishing Voice	Pink uses vishing (voice phishing) to impersonate IT personnel and lure targets into providing credentials.
Stealth	T1497.001	Virtualization/Sandbox Evasion: System Checks	Pink’s phishing kits detect virtualized graphics/environments, automated crawlers, default sandbox resolutions and timezones.
Stealth	T1497.002	Virtualization/Sandbox Evasion: User Activity Based Checks	Pink’s phishing kits delay execution until a real human interaction is identified and it detects automated bots through interaction with hidden elements.
Stealth	T1480	Execution Guardrails	Pink’s phishing kits are restricting their visibility until confirmation from the backend is received.
Credential Access	T1557	Adversary-in-the-Middle	Pink utilizes phishing kits to proxy credentials, MFA codes, and passkey registration requests in real-time.
Collection	T1213.002	Data from Information Repositories: Sharepoint	Pink collects sensitive files from sources like SharePoint and OneDrive after gaining a foothold.
Impact	T1657	Financial Theft	Pink performs data extortion, providing a DLS and deadline for communication.

Indicators of Compromise

passkeyactivate[.]com
activatepasskey[.]com
setupssopasskey[.]com
setupyoupasskey[.]com
setupyourpasskey[.]com
passkeysecuresetup[.]com
activatemypasskey[.]com
passkeyimplement[.]com
passkeymanage[.]com
secureauthpasskey[.]com
passkeyrollout[.]com
passkeyset[.]com
createmypasskey[.]com
addmypasskey[.]com
setupmypasskey[.]com
setupoktapasskey[.]com
passkeyregister[.]com
passkeyms[.]com
passkeysetup[.]com
passkeysupport[.]com
newpasskey[.]com
passkeycenter[.]com
addoktapasskey[.]com
passkeyportalsetup[.]com
registerpasskey[.]com
portalpasskey[.]com
passkeyregistration[.]com
passkeyokta[.]com
enrollpasskey[.]com
passkeyenrollment[.]com
addpasskey[.]com
deploypasskey[.]com
passkeydeploy[.]com
setpasskey[.]com
passkeyadd[.]com