🎯Basically, a new hacker group is tricking employees into giving up their passwords over the phone.
The Threat
A new financially motivated hacking group known as BlackFile has emerged, linked to a significant increase in data theft and extortion attacks. Since February 2026, this group has targeted retail and hospitality organizations, employing sophisticated tactics to impersonate IT helpdesk staff and extract sensitive employee credentials.
Who's Behind It
BlackFile, also tracked under aliases like CL-CRI-1116 and Cordial Spider, has been associated with a broader network of cybercriminals known as The Com. This loose-knit group is notorious for recruiting young individuals for various cybercrimes, including extortion and the production of child sexual exploitation material (CSAM).
Tactics & Techniques
The group's primary method involves voice phishing (vishing), where attackers call employees using spoofed numbers. They pose as IT support, directing victims to fake corporate login pages to capture their credentials and one-time passcodes. Once they have access, BlackFile registers their own devices to bypass multifactor authentication and escalate their access to sensitive executive-level accounts.
Data Exfiltration
Using stolen credentials, the attackers exploit Salesforce and SharePoint servers to extract sensitive data. They specifically search for files labeled as "confidential" or containing SSN information. The stolen data is then downloaded to servers controlled by the attackers and published on their dark web leak site before ransom demands are sent to victims.
Defensive Measures
To combat the rising threat posed by BlackFile, experts recommend several proactive measures: As the tactics of BlackFile mirror those of other known groups like ShinyHunters, organizations must remain vigilant and proactive in their cybersecurity strategies to mitigate the risks associated with these evolving threats.
Do Now
- 1.Strengthen call-handling policies: Ensure that employees verify the identity of callers, especially when sensitive information is involved.
- 2.Implement multifactor identity verification: Enforce strict verification processes for any caller claiming to be from IT support.
Do Next
🔒 Pro insight: The emergence of BlackFile underscores the need for enhanced employee training on social engineering tactics to mitigate vishing risks.
