Pink Extortion Crew Uses Fake IT Calls to Steal Microsoft 365 Data

A newly tracked extortion group known as Pink is using voice phishing and fake internal help-desk calls to trick employees into entering credentials and MFA codes on attacker-controlled phishing pages. Researchers tracking the activity as CL-CRI-1147 said the actor appears likely Com-affiliated and follows a social-engineering playbook associated with groups such as Lapsus$, Scattered Spider, and ShinyHunters. After account takeover, Pink rapidly accesses Microsoft cloud services including SharePoint and OneDrive, steals sensitive data, and then uses the compromised accounts to send extortion emails and internal Microsoft Teams messages to pressure victims.

Investigators said the group has also stood up a leak site and typically gives organizations 72 hours to respond to extortion demands. The campaign shows repeated infrastructure reuse across victims, with common second-level domains and victim-specific subdomains, and phishing hosting frequently tied to DDoS-Guard. Reported indicators include the domains passkeyadd.com, passkeydeploy.com, and deploypasskey.com, along with the IP addresses 185.178.208.153, 172.93.100.252, and 96.232.20.66, giving defenders concrete artifacts for threat hunting and blocking.