New Pink Extortion Group Targets Microsoft 365 via Voice Phishing

• •Pink extortion group uses voice phishing to steal Microsoft 365 credentials.
• •The group's data-leak site became active on May 31, 2026, listing multiple victims.
• •Pink is likely affiliated with the Com cybercriminal ecosystem, known for extortion tactics.

The newly identified Pink extortion group has emerged, utilizing voice phishing (vishing) tactics to gain access to Microsoft 365 accounts. Researchers from Unit 42 have tracked the group under cluster designation CL-CRI-1147, with their data-leak site going live on May 31, 2026. The group employs fake helpdesk calls to manipulate employees into revealing credentials, including multi-factor authentication (MFA) tokens. Once access is obtained, Pink rapidly exfiltrates sensitive data from cloud platforms like SharePoint and OneDrive. The group is believed to be affiliated with the broader Com cybercriminal ecosystem, which has a history of similar extortion tactics. Victims are pressured to pay ransoms within a 72-hour deadline to prevent data leaks. The emergence of Pink highlights a trend toward identity-driven attacks and exploitation of trusted cloud environments.