The Cyber Centre says several Canadian firms, mostly in the legal sector this month, have been called by people posing as internal IT support who claim an urgent passkey migration, MFA enrolment or password change is needed. Calls reach mobiles, desk phones or Microsoft Teams and may spoof the real help-desk number; callers hang up if the employee tries to verify independently. It ties the tradecraft to a financially motivated actor publicly reported as UNC6671 and "BlackFile", and has seen related infrastructure naming Canadian organizations since January.

• Lure pages: organization-branded adversary-in-the-middle sign-in pages, either as subdomains of generic domains (for example <org>.onetimesso[.]com, <org>.registermymfa[.]com) or new domains like <org>sso[.]com and <org>internal[.]com, mixing words such as activate, enroll, passkey, sso, mfa and okta. Domains rotate often, so blocklists help little.
• After login: the actor registers its own MFA devices, deletes password-reset and MFA-change notices, resets passwords for non-SSO apps, pulls SharePoint and OneDrive data with scripts and Microsoft Graph, then sends extortion demands.

What to do: move privileged and high-risk users to phishing-resistant MFA (FIDO2 keys or device-bound passkeys), require managed devices and block sign-ins from commercial VPNs, hosting ranges and residential proxies, tighten checks on MFA resets and new-device enrolment, alert on new MFA registrations, scripted bulk file access and deleted security emails, and limit external Teams calls and chats to partners you actually work with.