200 Wall Street financial firms hit by vishing: Blackstone, KKR, Apollo PE staff targeted with AiTM credential theft

Google Threat Intelligence reports that over the past five weeks, groups Redact, Pink, and Helix used vishing + AiTM against employees at 200 financial and PE firms including Blackstone, KKR, Apollo, Bain, CME, and Moodys. Ransom quotes ran $750k–$3M; some victims paid.

On 7 August 2026, Cailian Press and other outlets reported that over the past five weeks, financially motivated threat groups ran a large-scale vishing campaign against employees of at least 200 U.S. financial institutions and private-equity firms. Named targets include Blackstone, Bridgewater, Apollo, Bain, KKR, TPG, CME, Moodys, and Clearlake Capital. Google Threat Intelligence Group (GTIG) attributed the activity to clusters tracked as Redact, Pink, Falcon, and Helix, and said some victim companies paid ransoms of $750,000 to $3 million.

Incident overview

Activity ran mainly from late June to early August 2026. Attackers dropped malware and vulnerability-driven intrusion for a high-impact vishing + AiTM combo. In a 7 August blog, GTIG said criminal groups had stood up digital traps for at least 200 companies over the prior four to five weeks. Targeting shifted from the broader manufacturing and real-estate focus of April and May toward finance and legal.

Technical details

Three stages:

• Recon and contact: Attackers used LinkedIn and other public sources to confirm employee names, mobile numbers, and employers, then called personal phones via spoofed numbers or VoIP, impersonating IT help desks or MSPs with scripts such as mandatory security-system migration to gain initial trust.
• Lure login and AiTM: Staff were sent to fake employee SSO pages. Attackers ran AiTM (Adversary-in-the-Middle) proxy infrastructure to relay requests in real time, capturing usernames, passwords, and follow-on MFA including TOTP and FIDO push.
• M365 / Google Workspace compromise: Session cookies persisted by the MITM scripts let attackers call Microsoft 365 / Google Workspace APIs without logging in again, downloading mail, OneDrive / Drive content, corporate SharePoint / Sites, and critical finance, M&A, and HR files.

GTIG principal analyst Austin Larsen said the motive is money: attackers believe the data is sensitive enough that victims will pay to stop a leak. Industry sources say ransom models now tailor quote ranges to company size and ability to pay.

Impact

The wave hit large PE firms, hedge funds, exchanges, credit-rating agencies, and legal-service providers. Some executive mailboxes and M&A documents may involve undisclosed SEC information, creating secondary insider-trading or market-manipulation risk. Once personal credentials leak, attackers can reuse the same identity to move laterally into customer data centers and third-party SAAS (DocuSign, Sharefile, Carta). Even without credential abuse, firms may face legal and compliance exposure from stock-price disclosure or SEC inquiries.

Mitigation

• Training and process: Run anti-vishing training for all staff (especially front desk, HR, finance, and IT). Require help-desk identity verification via internal callback, not a single inbound call.
• MFA upgrade: Move all SAAS and VPN logins off interceptable TOTP/SMS to FIDO2 hardware keys or device-bound Passkey. AiTM proxies still fail hardware-key / WebAuthn origin checks.
• Session tightening: Enable Conditional Access short sessions, IP binding, and device-compliance policies for M365 / Workspace. Disable legacy SMTP / IMAP / POP that enable session replay.
• Mail and identity monitoring: In email gateways and CASB, enable high-risk rules for unusual-geo logins, bulk mailbox downloads in a short window, and background OAuth grants. Keep 24-hour IR capacity to immediately revoke passwords and sessions.
• Compliance and disclosure: Promptly assess potential SEC, FINRA, and GDPR reporting duties; prepare talking points for customers, regulators, and media.

References

• Cailian Press Hackers target Wall Street's money bags (Cailian Press Shanghai)
• Google Threat Intelligence Group Public Bulletin
• GTIG Cloud Threat Intelligence Blog
• Cyberscoop Vishing Campaign Coverage