Recommended Free Tools
Google Threat Intelligence Group has warned that a financially motivated campaign is targeting business-process-outsourcing companies and help-desk staff as a route into high-value corporate customers. The activity, reported on April 9, 2026, involves social engineering, fake Okta and Zendesk pages, theft of clipboard contents, unauthorized device enrollment and remote-access malware—not a confirmed vulnerability in Okta, Zendesk or another named vendor.
What Google reportedly found
SecurityWeek reported, citing Google Threat Intelligence Group (GTIG), that an actor tracked in the April report as UNC6783 targeted BPOs, outsourced support operations and help-desk personnel serving major companies. The apparent objective is to steal data and extort victims.
As an Amazon Associate I earn from qualifying purchases.
BPOs are attractive because one support operation may handle several customers and access customer-service platforms, employee records, internal conversations, bug reports and other connected SaaS systems. Compromising a trusted support identity can therefore provide an indirect path into a customer’s environment.
The report describes activity affecting high-value organizations across multiple industries. It does not establish that every BPO is under attack, provide a complete victim list or define a single geographic scope.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Google later announced a unified threat-actor naming system on July 24, 2026. “UNC6783” is retained here because it is the identifier used in the April reporting, but Google’s tracking name may later be mapped to or replaced by a cryptonym. See Google’s naming-system update.
How the reported attack chain works
- Target selection: Attackers identify a valuable company and the BPO or support provider serving it.
- Social engineering: They contact employees through live chat or support-style channels and create a plausible operational pretext.
- Credential harvesting: Victims are directed to spoofed Okta login pages or fake Zendesk support pages made to resemble the target organization’s environment.
- Authentication theft: The reported phishing tooling can steal clipboard contents, potentially capturing copied one-time codes or other authentication material.
- Persistence: After gaining access, attackers enroll an unauthorized device in the victim’s environment.
- Malware delivery: Fake security-software updates persuade victims to install remote-access malware.
- Data theft and extortion: Stolen information is exfiltrated, followed by ransom or extortion communications. SecurityWeek reported that Proton Mail accounts were used for ransom notes.
This should not automatically be described as a complete technical “MFA bypass.” The reported behavior is more accurately understood as phishing and credential or session interception combined with fraudulent factor or device enrollment. Conventional MFA can be defeated in practice when an attacker tricks a user into supplying authentication material or approving a new device.
Rank #2
- 【Professional Firewall & NAS SERVER】OAKNODE 10gbe Firewall Appliance Mini PC-MGNASN, a powerful professional firewall router pc equipped with a 12th Gen Alder Lake N100 4C/4T up to 3.4GHz TDP only 6W with Intel UHD Graphics which maximizes the performance of the 2.5GbE port & SFP+ port, bring you a smooth secured and encrypted network environment.
- 【Rich I/O to meet your needs】Firewall Appliance MGNASN With HDMI 2.0+DP 1.4+TYPE-C(dp 1.2) Support for 3x4K@60Hz together, Dual DDR4 RAM slot support for up to 1x32GB SO-Dimm laptop DDR5 Ram Maximum 5600Mhz and 1xM.2 NVMe/PCIe 3.0x1 2280 SSD slot +1*SATA 3.0 SSD/HDD slots (install externally), also it support boot from TF card slot and it also support PXE/AWOL/Watchdog/GPIO etc. which is perfect for your firewall appliance、VM、Router、home Server needs.
- 【2xSFP+ 10GbE + 4x2.5GbE】This Firewall Router equipped with 2xIntel 82599ES 10gbe network card and 4*Intel i226-V network card speed maximum up to 2.5GbE(need other device like router, cables etc. also support 2.5Gbe/10gbe)which can bring you more faster and professional network usage(some system not release drivers yet) suggest to install version of below systems: pf-sense plus 23.0X or CE 2.7.X, OPNsense 22.1, OpenWrt, ROS7, ESXI 8 , Proxmox, CentOS etc).
- 【4G LTE Function supported】This model also support 4G LTE function(mini PCIE slot for 4G modem) and SIM card slot which you can use it as a IOT devices for your server.
- 【Quality With Warranty】If you have any questions or requirements(like OS installation/ drives/bios updates etc.) on OAKNODE Firewall mini pc MGNASN, PLEASE feel free to contact us. We offered 12 Months warranty for it and WE'LL REPLY YOUR Questions within 12 hours(during Workdays).
The available reporting does not establish a zero-day, database compromise or direct breach of Okta or Zendesk. Google’s broader reporting on SaaS data-theft campaigns likewise emphasizes social engineering rather than a flaw in the vendor’s infrastructure, although that broader context should not be treated as proof that every campaign detail is identical. Google’s SaaS threat guidance explains the distinction.
Why BPOs are a high-value access path
A BPO is part of an enterprise’s attack surface, even when it is legally classified as a third-party supplier. Support agents may be expected to work quickly, handle account recovery and password-reset requests, verify identities, escalate incidents and move between several customer systems.
Rank #3
- BUSINESS READY - pfSense+ software updates included for product lifetime. Netgate TAC Lite technical support included. One year hardware warranty included.
- COMPLETE - Pre-loaded with pfSense+ software to get up and running fast. Simply unbox it and start customizing for your secure edge networking needs. Free help with setup from our expert Technical Assistance Center (TAC) available 24/7/365.
- POWERFUL - A dual core ARM Cortex-A53 1.2 GHz delivers near gigabit routing of common home iPerf3 traffic and in excess of 650 Mbps of firewall throughput.
- COMPACT - Low power draw, a compact form factor, and silent operation allow it to run unnoticed when placed on a desktop, wall, or rack.
- FLEXIBLE - Three (3) 1 GbE switched (WAN/LAN/OPT) ports allow you to configure three separate 1 GbE switched ports for upto a gigabit of bi-directional traffic.
That combination creates several risks:
- A single compromised agent may expose multiple customer environments.
- Help-desk workflows can carry authority to reset passwords, change authentication factors or unlock accounts.
- Shared workstations and operational tools may blur boundaries between customers.
- Customers may assume the BPO is monitoring identity events while the BPO assumes the customer is doing so.
- Contractual responsibility for detection, notification and evidence preservation may be unclear.
The central lesson is not that BPOs are inherently insecure. It is that outsourced identities must be governed with the same rigor as internal privileged identities.
What data could be exposed?
The possible exposure depends on the compromised account’s permissions. It may include customer support tickets, employee personal information, internal support conversations, product or engineering details, bug-bounty submissions and information in connected SaaS applications. Clipboard theft may also expose authentication codes or other sensitive material copied by an employee.
Rank #4
- 【Processor & OS】Firewall Mini PC with Intel J3710 CPU up to 2.64GHz, 4Cores 4threads 2MB L2 Cache, TDP 6.5w, supports AES-NI. It tested with pf-sens/opn-sense linux ubuntu and other popular open source os. ("DEL" key to enter BIOS)
- 【Interfaces】The firewall pc has 4 * Intel I226 lan ports, 2 * USB3.0 ports, 1 * RS232COM port, 2 * HD port, 1 * DC port. Equipped with VESA mount, you can install the micro pc behind the monitor to save space.
- 【Fanless Design】only 6.5W; fanless heat dissipation design, aluminum alloy shell, efficient and fast heat dissipation, which can withstand temperatures up to 60°C. support 24/7 hours working, no noise.
- 【RAM & Storage】The firewall router equipped with 8G DDR3 RAM, max support 8GB; 128GB mSATA SSD, up to 512GB. Not support HDD. Size:5.27 * 4.98 * 1.43 inches, Weigh:500g, small but powerful.
- 【12 Months Service】You will get a firewall pc and accessories，If you encounter any problems during the use, please contact us through Amazon, we have a professional and efficient team dedicated to serving you.
SecurityWeek reported that a hacker using the name “Mr. Raccoon” claimed access involving 15,000 Adobe employees, millions of support tickets and bug-bounty submissions. Those figures are claims, not confirmed breach totals. The alleged connection between Mr. Raccoon and UNC6783 is also an attribution lead, not a proven identity match. Any Adobe-related compromise should therefore be described as an allegation unless independently confirmed by Adobe or another authoritative investigation.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsWhat BPOs should do immediately
1. Strengthen authentication and device enrollment
- Require phishing-resistant MFA—preferably FIDO2/WebAuthn security keys or passkeys—for help-desk staff, administrators and other high-risk users.
- Require separate, higher-assurance approval for new device enrollment, password resets, MFA resets and privilege changes.
- Review recently added devices and authentication methods.
- Alert on unfamiliar locations, impossible travel, unusual authentication factors and abnormal sessions.
- Revoke active sessions and tokens after suspected phishing rather than merely changing the password.
2. Fix help-desk recovery procedures
- Do not approve password or MFA resets using information supplied only during an inbound call or chat.
- Use a callback to a pre-registered number or another independent trusted channel.
- Require dual approval for high-risk account recovery.
- Ensure handle-time targets never override identity-verification requirements.
- Escalate suspicious login pages, fake vendor alerts and unexpected device-enrollment requests.
3. Control endpoints and browsers
- Block unapproved remote-access tools.
- Use endpoint detection and response or application allowlisting on support workstations.
- Prevent manual installation of “urgent” updates outside approved management channels.
- Use managed browsers with phishing protection and domain controls.
- Monitor sensitive systems for suspicious browser extensions, scripts or processes accessing clipboard contents.
- Separate administrative work from ordinary browsing and email wherever practical.
4. Reduce SaaS and customer-access exposure
- Apply least privilege to every BPO role.
- Use separate identities or clearly separated access boundaries for different customers.
- Restrict access by device posture, network, geography and working hours where operationally feasible.
- Review OAuth grants, API tokens, forwarding rules, mailbox delegates and connected applications.
- Retain logs for authentication, device enrollment, privilege changes and unusual data exports.
What customers should require from BPO providers
Customers should treat BPO access as a material third-party risk, not a procurement checkbox. Ask the provider:
Best Value
- 【CPU Optimized for Firewall Mini PCs】This firewall appliance is powered by Intel Quad-Core Celeron J1900, 64-bit, up to 2.0 GHz, supporting software-based encryption. Energy-efficient and reliable, it runs 24/7 for home or small office networks, handling VPNs, multi-WAN routing, and basic firewall tasks efficiently.
- 【4×Intel i210 Ports】Equipped with four Intel i210 network controllers, each delivering up to 1 GbE for reliable multi-WAN routing, VPN connections, VLAN management, and stable performance in small office or home firewall deployments
- 【Memory & Storage】This Firewall Mini PC comes with 4 GB DDR3L RAM and a 64 GB mSATA SSD, providing reliable performance for basic networking tasks. AMI BIOS with ACPI support ensures stable system operation and energy-efficient 24/7 use
- 【Flexible System Compatibility】Compatible with Windows 10, Linux, and professional firewall systems such as pfSense, OPNsense, and VyOS, ensuring stable network management for home or small office use
- 【After-Sales Support:】This compact, fanless, and silent firewall keeps your network secure. Includes lifetime technical support and a 30-day money-back guarantee!
- Which identity provider protects agent accounts?
- Is phishing-resistant MFA required for privileged and help-desk roles?
- Who can approve a new device or authentication factor?
- Are password and MFA resets independently verified?
- Are customer environments logically separated?
- How quickly can suspicious accounts and sessions be disabled?
- Are endpoint, identity and SaaS logs retained and available for investigation?
- Can the provider identify all data accessible to each role?
- Has it tested fake-support, phishing or voice-social-engineering scenarios?
- What is the contractual deadline for notifying customers of suspected credential theft?
Contracts should also define evidence preservation, customer communications, incident-response responsibilities and the authority to suspend access during an investigation. A provider should not receive broad access to several customers when narrower permissions would work.
Response steps after suspected compromise
- Preserve evidence: Save identity-provider, SaaS, endpoint and email logs before wiping devices or deleting accounts.
- Contain the account: Suspend the suspected identity and revoke active sessions, refresh tokens, API tokens and connected applications.
- Remove persistence: Delete unauthorized devices and authentication factors, then reset credentials from a known-clean device.
- Inspect the account: Review mailbox rules, forwarding, OAuth grants, administrative changes and unusual exports.
- Isolate endpoints: Quarantine any workstation that may have received remote-access malware.
- Assess access: Determine which customer systems and records the account could read, export or modify.
- Hunt broadly: Search for the same phishing domains, messages, device enrollments, malware and authentication anomalies across the organization.
- Coordinate notifications: Engage legal, privacy, regulatory and customer-notification teams according to contractual and jurisdictional requirements.
- Monitor for extortion: Watch for ransom demands or publication of allegedly stolen data.
What this campaign does—and does not—show
The campaign demonstrates the limits of relying on passwords, ordinary MFA, informal help-desk verification and broad third-party access. It does not show that Okta or Zendesk was breached, that either vendor had a product vulnerability or that all reported victim claims are confirmed.
It also does not mean phishing-resistant MFA solves the entire problem. Security keys and passkeys reduce credential-phishing risk, but organizations still need controlled device enrollment, endpoint protection, least privilege, customer separation, SaaS monitoring and well-designed recovery procedures.
Free tools Windows power users keep installed
One-click scans. No signup required.
Security controls involve trade-offs. Security keys require enrollment, spares and account-recovery planning. Device restrictions can complicate shift changes. Dual approval can increase handling time. Per-customer identities and strict clipboard controls can disrupt legitimate workflows. Those costs should be measured against the far larger potential cost of allowing one trusted support identity to reach several customer environments.
Bottom line
Google’s reported warning is best understood as a third-party identity-security problem. Attackers are reportedly using BPO employees and help-desk workflows as trusted routes to corporate data through impersonation, phishing, unauthorized device enrollment and malware delivery. Organizations should start by reviewing new devices and authentication factors, enforcing phishing-resistant MFA, tightening account recovery, blocking unapproved remote-access software, auditing SaaS access and testing whether their BPO contracts and monitoring can support a rapid response.
Quick Recap
Read SecurityWeek’s report on the campaign.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
