Hackers Target Wall Street Firms With AI Voice Phishing

Ransom-seeking hackers launched a wave of voice phishing, or vishing, attacks against dozens of prominent U.S. financial institutions and businesses ending in early August 2026. The attackers, operating under aliases including Redact, Pink, Falcon, and Helix, used phone calls to impersonate company help desks. They tricked employees into visiting malicious websites to steal passwords and multifactor authentication codes, often utilizing AI technology to mimic voices.

Targeted entities included major hedge funds such as Citadel, Point72 Asset Management, Two Sigma Investments, and Millennium, as well as private equity giants Blackstone, Apollo Global Management, KKR, and Bain Capital. Other targets spanned various industries, including Uber, Zillow, CME Group, Moody’s, and the law firm Greenberg Traurig. Point72 and Two Sigma reported no impact to their systems or customer data, and Greenberg Traurig denied any data breach.

Google's Threat Intelligence Group reported that the hackers pivoted to the financial sector because these firms possess highly sensitive data and the financial means to pay ransoms. While Google noted some unnamed companies paid these ransoms, the Financial Industry Regulatory Authority coordinated responses among member firms through its Financial Intelligence Fusion Center portal.