🎯 Threat Intelligence

BlackFile Group: "Living Off the Land" Attacks Escalating

Forget zero-days. BlackFile's latest campaign is a masterclass in social engineering and API abuse, targeting vulnerable retail and hospitality giants. This isn't just about stealing credentials; it's about maintaining persistence and exfiltrating vast amounts of data undetected.

Threat Digest Apr 27, 2026 5 min read

A stylized illustration of a person on the phone, with digital network lines emanating from them and intertwining with corporate building icons.

⚡ Key Takeaways

BlackFile Group use vishing and social engineering to steal credentials and bypass MFA. 𝕏
The group excels at "living off the land," exploiting legitimate APIs and internal tools. 𝕏
Targeted data exfiltration from SaaS platforms like SharePoint and Salesforce is a primary objective. 𝕏
Extortion tactics include seven-figure demands and alarming acts like SWAT-ing. 𝕏