Loading story…
Voice phishing is emerging as a major initial-access tactic as attackers impersonate employees, help-desk staff, and senior officials to steal credentials, capture one-time passcodes, and transfer MFA enrollment. U.S. government warnings and industry reporting describe malicious messaging and vishing campaigns that use phone calls, SMS, and collaboration platforms such as Microsoft Teams to manipulate targets into granting access to single sign-on and cloud environments. Group-IB and CIS both report that advances in synthetic speech, real-time voice transformation, and voice cloning are lowering the cost and skill barrier for these scams, while incident data cited by defenders shows vishing accounting for a growing share of intrusions.
The technique has been linked to serious downstream compromises, including an alleged ShinyHunters breach at Harvard University in which attackers reportedly used voice phishing to bypass MFA and access Microsoft 365, SharePoint, and Salesforce, exposing roughly 115,000 records tied to alumni and development operations. Security guidance across the referenced reporting urges organizations to harden identity workflows rather than rely on user recognition of suspicious calls, with emphasis on phishing-resistant MFA such as FIDO2, stricter help-desk identity verification, protection of passkey enrollment, and monitoring for anomalous authentication and account-recovery activity.
Get the infrastructure and lures behind it.
10 events from the most recent confirmed update back to the earliest known activity.
Group-IB reported that threat actors were operationalizing AI voice capabilities through synthetic speech from scripts and real-time voice transformation, while noting voice cloning was becoming more accessible.
A breach at Harvard University allegedly occurred on February 4, 2026 and was attributed in the source to ShinyHunters. The incident reportedly exposed about 115,000 records from the Alumni Affairs and Development department.
On May 15, 2025, the FBI's IC3 published a public service announcement warning that malicious actors were impersonating senior U.S. officials in messaging campaigns to compromise accounts and enable further malicious activity.
The FBI said threat actors had impersonated senior U.S. officials using AI-generated voice messages and fraudulent texts since at least April 2025, targeting current and former federal and state officials.
Mandiant's M-Trends 2026 report documented that vishing accounted for 11% of initial access cases in 2025, making it the second most common vector, while email phishing fell to 6% from 14% the prior year.
CrowdStrike reported a 442% increase in vishing between the first and second halves of 2024, indicating rapid growth in voice-based social engineering.
CrowdStrike researchers reported that device code phishing and voice phishing attacks had more than doubled, with attackers increasingly combining phone calls and mobile authentication workflows. The tactic tricks users into approving fraudulent device authentication requests, enabling access to corporate networks through social engineering.
The CIS CTI team said it observed incidents in the first eight months of 2026 in which attackers posing as help desk personnel targeted U.S. state, local, tribal, and territorial organizations to gain unauthorized access to SSO environments.
In April 2026, ShinyHunters reportedly targeted an employee at a widely used physical security firm with a vishing call, accessed the firm's enterprise account, pivoted into Salesforce, and exfiltrated about 5.5 million customer records.
In April 2026, ShinyHunters reportedly used a vishing call to compromise a major telecom company employee's Microsoft Entra account, then pivoted into Salesforce and exfiltrated customer records.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
7 references tracked. Mallory keeps watching after this page renders.
blog.knowbe4.com
Open sourcezimperium.com
Open sourcegroup-ib.com
Open sourcehudsonrock.com
Open sourcecisecurity.org
Open sourceic3.gov
Open sourcecloud.google.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A series of social-engineering campaigns targeted organizations that relied on **Okta** and similar identity systems, using SMS phishing, fake login portals, and later voice calls impersonating IT staff to steal credentials, MFA codes, and session tokens. Group-IB said the **0ktapus** operation targeted **136 organizations**, used **169** lookalike domains, and compromised thousands of accounts, with victims concentrated in technology, software, and cloud sectors in the United States and Canada. Reporting tied the same activity to breaches at **Twilio**, **Cloudflare**, **DoorDash**, and later **Coinbase**, where an attacker obtained an employee username and password and accessed limited corporate directory data but was blocked from broader access by MFA controls and incident response. Subsequent reporting described an evolution from SMS phishing to **vishing** and adversary-in-the-middle phishing kits that mirrored corporate SSO flows in real time, enabling theft of session tokens even after MFA was completed. Mandiant and other researchers linked a 2026 wave under the **ShinyHunters** banner to more than **400 organizations**, with attackers using branded phishing sites, harvesting cloud data from **SharePoint**, **OneDrive**, **Salesforce**, and **Slack**, and following theft with extortion demands. Across the incidents, phishing-resistant **FIDO2** security keys stood out as an effective defense, while earlier disputes over Okta-related intrusions, including claims by **Lapsus$**, underscored how compromises of identity providers and support channels can cascade into downstream customer exposure.
Jun 29, 2026
Researchers have demonstrated that advancements in artificial intelligence have significantly increased the risks associated with voice cloning, particularly in the context of vishing attacks. Using as little as five minutes of recorded audio, attackers can now generate highly realistic voice clones capable of engaging in real-time conversations. This technological leap allows threat actors to conduct sophisticated social engineering attacks, making it increasingly difficult for targets to distinguish between genuine and simulated voices. The NCC Group's research team has explored these capabilities, showing how AI-powered voice impersonation can be leveraged to compromise organizations and extract sensitive information. Their findings indicate that enterprises, employees, and individuals are all at heightened risk of falling victim to these attacks, which can be used to obtain personal information, financial data, or corporate credentials. The research included a demonstration of a real-time voice clone, underscoring the immediacy and realism of the threat. While the technical details of the exploit were withheld to prevent misuse, the researchers warned that some threat actors are likely already employing similar techniques. Vishing, or voice phishing, traditionally involves tricking targets over the phone, but the integration of AI voice cloning makes these attacks more convincing and harder to detect. Attackers may impersonate family members, IT staff, or other trusted individuals to manipulate victims into divulging sensitive information or granting remote access. The NCC Group's simulation services have highlighted the practical application of these techniques in real-world scenarios, emphasizing the need for organizations to update their social engineering prevention strategies. The research also points to the broader implications for security awareness training, as traditional cues for detecting fraud may no longer be reliable. The rise of deepfake vishing represents a significant evolution in the threat landscape, requiring both technical and procedural countermeasures. Organizations are advised to implement multi-factor authentication and robust verification processes to mitigate the risks posed by AI-driven voice impersonation. The findings stress the urgency for enterprises to reassess their security protocols in light of these emerging threats. As AI technology continues to advance, the potential for abuse in social engineering attacks is expected to grow, making proactive defense measures essential. The research serves as a warning that the line between authentic and artificial communication is becoming increasingly blurred, demanding heightened vigilance from both organizations and individuals.
Jun 29, 2026
Okta reported that threat actors are using and selling custom **voice-phishing (vishing) kits** that enable helpdesk-style social engineering to steal credentials and bypass MFA for **Okta SSO** and other identity providers, including **Google** and **Microsoft**. The kits are offered “as a service” on dark web forums and messaging platforms and are designed to closely mimic legitimate identity-provider authentication flows, making the victim experience appear authentic during a live phone call. Unlike static phishing pages, the kits function as **adversary-in-the-middle** platforms that let attackers monitor a victim’s session in real time and dynamically change what the victim sees (e.g., dialogs prompting for credentials or MFA approval) as the call progresses. Okta said operators typically conduct reconnaissance on targeted employees (names, applications used, and IT/helpdesk phone numbers), then call victims—often with spoofed corporate/helpdesk numbers—while guiding them through a tailored phishing page; captured credentials and MFA responses are relayed to the attacker to complete login and enable downstream **data theft and extortion** activity, echoing prior “IT support call” tradecraft associated with **Scattered Spider-like** intrusions.
Jun 29, 2026