Loading story…
Cybercriminals are increasingly using phone-based social engineering to breach corporate networks, with BazaCall-style campaigns relying on fake subscription or billing emails that pressure recipients to call attacker-controlled numbers. During the call, operators posing as customer support staff persuade victims to visit malicious sites, open booby-trapped files, or install remote access tools, allowing malware such as BazaarLoader, TrickBot, and IcedID to gain a foothold while bypassing many traditional email defenses.
Threat researchers linked these call-center tactics to broader intrusion chains involving data exfiltration and ransomware, including activity associated with affiliates tied to Hive and Quantum. The operations have targeted organizations in the US, UK, Canada, and parts of Asia, with manufacturing and legal firms among the sectors observed, and have evolved into an organized underground service model that uses multilingual callers, spam lures, toll-free numbers, and ISO attachments to improve initial access success rates.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Cofense published research describing mass-distributed phone scam emails that impersonate trusted brands and pressure recipients to call attacker-controlled numbers. The report says attackers increasingly use AI to generate convincing, polymorphic lure emails at scale and highlighted tactics such as fake invoices and GitHub-linked invoice pages to add legitimacy.
Seqrite published research describing organized underground caller services used by ransomware affiliates, including actors linked to Hive and Quantum, to target organizations in sectors such as manufacturing and legal services in the US and Canada.
On its security blog, Microsoft Threat Intelligence reported on the BazaCall campaign, describing how fake call centers trick victims into installing malware that can lead to data exfiltration and ransomware deployment.
Seqrite said BazaCall-style phone-assisted malware delivery had been observed since 2021, with victims persuaded over the phone to click links, open attachments, or grant remote access as part of ransomware intrusion chains.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
5 references tracked. Mallory keeps watching after this page renders.
onlinethreatalerts.com
Open sourcecofense.com
Open sourceseqrite.com
Open sourcemicrosoft.com
Open sourcetrellix.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports describe **social-engineering campaigns** that use trusted-looking lures (meeting invites, public-safety alerts, and official-looking documents) to drive victims to install malware or disclose credentials. Microsoft researchers reported a wave of **fake Zoom/Teams/Adobe update sites** reached via meeting-invite and document lures; the downloaded executables were signed with a **compromised EV code-signing certificate** (issued to *TrustConnect Software PTY LTD*) and acted as droppers for **remote monitoring and management (RMM) tools**, enabling persistent access. Separately, ClearSky described a suspected **Russian espionage** phishing operation targeting Ukraine that delivers a ZIP containing a Ukrainian-language border-crossing “permit” document, installing a loader (**BadPaw**) and a backdoor (**MeowMeow**) with file manipulation capabilities and sandbox/VM evasion; attribution was assessed as high confidence to a Russian state-aligned actor and low confidence to **APT28**. Mobile-focused lures were also reported: CloudSEK detailed **SMS phishing** targeting Israeli civilians with a trojanized **Red Alert** rocket-warning app, using a multi-stage loader chain to deploy spyware with **banking trojan** capabilities and exfiltrate **SMS, contacts, and location** to attacker infrastructure—raising concerns about surveillance and erosion of trust in official alerting. Other items in the set are either broader research or consumer-oriented scam advisories: a Zimperium write-up on the Android **“Massiv”** IPTV-app disguise highlights overlay-based banking fraud techniques, while Kaspersky’s mobile threat landscape report provides 2025 ecosystem statistics; two OnlineThreatAlerts posts describe generic **smishing** patterns (Amazon “refund” and flood-warning texts) without tying to a specific, evidenced campaign or new technical findings.
Jun 29, 2026
Multiple reports describe **phishing-led malware delivery** that abuses trusted services and “living off the land” execution paths to evade controls and deploy remote access tooling. Cloudflare-tracked activity shows attackers using **Vercel-hosted** pages to lend legitimacy to malicious links and bypass email/security filtering, with lures themed around invoices, payments, shipping, and document portals; the infrastructure includes **Telegram-based filtering** and browser fingerprinting/conditional delivery to hinder researchers and sandboxes before serving payloads that install a **remote access tool (RAT)**. A separate campaign (tracked as **PHALT#BLYX**) targets hospitality staff with Booking[.]com-style reservation emails and uses a **fake browser error + fake BSOD** to coerce victims into running the **ClickFix** technique (Win+R paste/execute), launching PowerShell that pulls malicious project files and executes them via **`MSBuild.exe`** to deliver **DCRat**, consistent with **LOLBins**-based evasion; researchers noted Russian-language artifacts in the malware. Broader weekly/newsletter roundups also highlight the same risk theme—attackers increasingly blend social engineering with trusted infrastructure and tools—while mixing in unrelated items (e.g., firewall CVEs, general malware research links) that are not part of a single, specific incident narrative.
Jun 29, 2026
Multiple reports describe **social-engineering-driven initial access** where victims are coerced into executing attacker-supplied scripts rather than being exploited via a software vulnerability. The “Voicemail Trap” campaign uses fake voicemail notifications (often styled as routine business communications and sometimes impersonating financial entities) to drive targets to compromised, bank-themed web infrastructure that mimics an audio player and instructs users to download and run a **Windows BAT** file disguised as a media/codec update; researchers observed dozens of distinct web properties supporting the lure and the execution chain is designed to blend in as legitimate system maintenance while leveraging built-in administrative tooling to reduce AV detection. Separately, an investigation attributed to **BlueNoroff** (a financially motivated subgroup of **Lazarus**) documented a macOS compromise that begins with outreach on messaging platforms (e.g., Telegram) and escalates into a Microsoft Teams call where the attacker claims an “audio issue” and coaches the victim to paste terminal commands that download and execute a payload. The malware is written to a benign-looking path such as `/Library/Caches/com.apple.sys.receipt`, then made executable (e.g., `chmod 777`) and **ad-hoc signed** to appear more legitimate and bypass some security checks; the targeting focus is professionals in cryptocurrency/financial sectors. A third item describes a **Facebook paid-ads malvertising** chain that redirects users through decoy sites to a tech-support scam kit and rotates domains rapidly, but it is a distinct campaign from the voicemail and fake-audio troubleshooting lures.
Jun 29, 2026