Hackers Built 72 Spoof Sites and Called Employees at Blackstone, Apollo, KKR to Extort Up to $750,000

Google researchers warned that hackers tracked as UNC6671 built 72 malicious websites and made direct phone calls to employees at Blackstone, Apollo, KKR, Bain Capital, and Bridgewater. The attackers tricked staff into entering passwords and MFA codes via spoofed login portals. Some attacks netted ransoms up to $750,000. Apollo confirmed its cloud systems were breached July 6–10, 2026.