Skip to content

Topic

Voice Phishing and Help-Desk Impersonation

Phone-based social engineering where attackers pose as IT or help-desk staff to trick employees into giving up passwords, codes, or session access.

Current stories

investOne report1 publisher

Korean lender owes a son the 50 million won its teller paid to his scammed mother, FSS panel rules

South Korea's FSS dispute panel says a lender should repay a son 50 million won plus interest after a teller closed his deposit for his scammed mother. The panel treats the scammer as the party that benefited, so the firm is unlikely to recover the money from her.

Publishers:en.sedaily.com

Reality

Evidence55
Adoption
Not scored
Hype gap+10
Incentives
Not scored
Confidence55
securityOne report1 publisher

BlackFile wears four extortion brands, so your threat feed is counting one actor as several

Google says UNC6671 split its extortion into Redact, Pink, Helix and Falcon on shared infrastructure while still working finance, legal and med tech. It averages 1.5 new victims a day.

Publishers:cyberscoop.com

Reality

Evidence55
Adoption
Not scored
Hype gap+20
Incentives45
Confidence55
securityConfirmed4 publishers

Ten cents a call: Activation Lock bypass now ships with its own voice agent

SOCRadar's teardown of the AnonyMousKIT service found 200 AI-voiced calls at about $0.10 each, most of them to Brazil. The skill in phone social engineering is now a script file.

Perspective Coverage

4 publishers
Builder
Builder 19%
Operator
Operator 76%
Investor
Investor 5%

Reality

Evidence70
Adoption40
Hype gap+35
Incentives40
Confidence65
securityConfirmed3 publishers

Spring Ring impersonated the help desk over external Teams accounts to relay NTLM at domain controllers

Unit 42 says the crew reached more than 150 employees at ten or more companies without a single software exploit, which puts Teams federation policy and NTLM relay hardening in scope and leaves the endpoint downstream.

Perspective Coverage

3 publishers
Builder
Builder 28%
Operator
Operator 65%
Investor
Investor 7%

Reality

Evidence55
Adoption
Not scored
Hype gap+20
Incentives70
Confidence60
securityConfirmed9 publishers

McKesson's 8-K locates the stolen data inside third-party applications

The distributor found the intrusion on August 25, 2026, the same day ShinyHunters says its four-day exfiltration ended. It has not named the vendor applications involved, so customers are left scoping their own integrations.

Perspective Coverage

9 publishers
Builder
Builder 17%
Operator
Operator 66%
Investor
Investor 17%

Reality

Evidence50
Adoption
Not scored
Hype gap+40
Incentives70
Confidence55
investOne report1 publisher

Klarna answers spoofed caller ID with an in-app banner in four Nordic markets

Call Status Detection is live in Sweden, Norway, Finland and Denmark, switched on by default on iPhone and opt-in on Android, and Klarna pointed to the ECB's estimate of more than 4 billion euros a year in European fraud to explain why.

Reality

Evidence42
Adoption32
Hype gap+18
Incentives68
Confidence46
securityOne report1 publisher

Both banks Everest named in April traced the breach to a third-party vendor

Intel 471's 18-month sweep of the underground counted 340 financial-sector extortion victims across 74 countries, 159 firms with access for sale and 562 claimed DDoS attacks. The dated intrusions came in through vendors and help-desk calls.

Publishers:intel471.com

Reality

Evidence40
Adoption55
Hype gap+22
Incentives78
Confidence47