Wall Street ransom plot relies on simple phone scams

Hackers are using basic social-engineering to trick employees at major Wall Street firms into revealing passwords and MFA codes by spoofing internal IT helpdesk numbers and directing staff to fake passkey websites. The campaign targeted over 200 companies in about five weeks, including Blackstone, KKR, Apollo Global Management, Bain Capital, CME Group and others; some victims reportedly paid ransoms while many intrusions were blocked. The attackers use voice calls and booby-trapped sites to harvest credentials and hijack accounts in real time, illustrating a persistent human-factor vulnerability despite high-tech defenses.