As reported by Security Affairs, a coordinated credential-harvesting campaign has erected fake IT help desk infrastructure specifically designed to compromise employees at some of the world's most prominent financial institutions — including Blackstone, KKR, Bridgewater Associates, Apollo Global Management, and Moody's. Operating under aliases such as Redact, Pink, Falcon, and Helix, these threat actors have reportedly targeted over 200 firms with purpose-built credential-stealing sites that bypass multi-factor authentication.

Key Takeaway: As reported by Security Affairs, a coordinated credential-harvesting campaign has erected fake IT help desk infrastructure specifically designed to compromise employees at some of the world's most prominent financial institutions — including Blackstone, KKR, Bridgewater Associates, Apollo Global Management, and Moody's.

Why This Campaign Is More Dangerous Than a Phishing Email

This isn't a spray-and-pray phishing operation. The targeting of private equity giants, alternative asset managers, and financial data firms suggests that threat actors are after something far more valuable than individual credentials — they're after deal flow data, investor PII, fund structures, and potentially material non-public information (MNPI). A successful breach at any of these institutions could have cascading consequences across portfolio companies and market participants.

What makes this attack pattern particularly insidious is the use of adversary-in-the-middle (AiTM) proxy techniques combined with human social engineering. Attackers aren't just building convincing login pages — they're likely staffing fake help desk personas that interact with victims in real time, walking employees through "verification" steps that ultimately hand over session tokens or OTP codes. This real-time human element dramatically increases success rates compared to static phishing lures.

Shield53 Analyst Note: MFA is not a silver bullet. AiTM frameworks like Evilginx2 and Modlishka can transparently proxy authentication sessions, capturing session cookies that render OTP-based MFA completely ineffective. The only MFA that resists this attack class is FIDO2/passkey-based authentication.

The Financial Sector's Unique Exposure

Financial services firms — especially alternative investment managers — present an exceptionally attractive target profile for several reasons:

The Financial Sector's Unique Exposure
High-value data density: Fund performance data, LP lists, acquisition targets, and transaction timelines are extraordinarily valuable for insider trading, extortion, or sale to competitors and nation-state actors.
Distributed workforces: Private equity and hedge fund employees frequently work across time zones, rely on third-party systems, and engage with a wide range of external vendors — creating fertile ground for impersonation.
IT support outsourcing: Many mid-sized financial firms outsource helpdesk functions, meaning employees may be genuinely unsure who their "legitimate" IT support vendor is — making spoofed help desks harder to detect.
Regulatory pressure as a social lever: Attackers can exploit awareness of SEC, FINRA, or DORA compliance requirements to create urgency ("Your account must be re-verified to maintain compliance").

Attack Chain Breakdown

Based on the observed infrastructure and tactics, Shield53 assesses the likely attack chain follows this pattern:

  • Reconnaissance: OSINT harvesting from LinkedIn, fund websites, and regulatory filings to identify employee names, roles, and email formats.
  • Lure delivery: Spear-phishing emails or SMS/voice vishing impersonating internal IT or a known managed service provider, directing targets to a cloned portal.
  • AiTM credential capture: Fake portals proxy authentication to real corporate identity providers, capturing session cookies in real time.
  • Post-compromise: Lateral movement through email, SharePoint, or VPN access — potentially leading to business email compromise (BEC), data exfiltration, or persistent access sold to other threat actors.

Shield53 Recommendations

Immediate Actions

  • Migrate to FIDO2/passkey authentication immediately for all privileged and remote access. Hardware security keys (YubiKey, etc.) are the only credential type immune to AiTM proxy attacks.
  • Deploy conditional access policies that enforce device compliance and geographic restrictions — flag or block logins from unexpected locations or unmanaged devices.
  • Hunt for AiTM infrastructure indicators in your DNS and proxy logs — look for recently registered domains mimicking your firm's identity provider, SSO portal, or IT ticketing systems (e.g., ServiceNow, Okta).
  • Implement session anomaly detection: monitor for session tokens being reused from IP addresses that differ from the authentication IP — a hallmark of AiTM cookie theft.

Strategic Controls

  • Establish a verified IT support callback protocol. Employees should never act on inbound IT support contacts — all helpdesk interactions should be initiated through a known, internal channel (e.g., ticketing portal, known phone number). Train employees to hang up and call back.
  • Conduct targeted vishing simulations against finance, executive assistants, and operations staff — these are the highest-risk employee cohorts for IT impersonation attacks.
  • Monitor for credential exposure via dark web intelligence services — threat actors operating this type of infrastructure often sell access before pivoting to exfiltration.
  • Engage your identity provider (Okta, Azure AD, Ping) to enable high-assurance authentication policies for sensitive application access, including number-matching and context-aware MFA prompts.

The campaign described here is a sharp reminder that sophisticated threat actors are evolving past technical exploits and doubling down on human deception. For financial institutions managing trillions in assets, the cost of a single compromised session can far exceed what any ransomware payment would demand. Defense must be equally sophisticated.