Vishing and Help Desk Impersonation: Social Engineering by Phone

Vishing (voice phishing) is a social engineering attack in which the attacker phones the victim, poses as a trusted person or organisation and persuades them to share information or take an action. One of the most common scenarios is help desk impersonation: "We're calling from IT, there's a problem with your system." As employees become more careful with links in emails, attackers are moving to the phone, text messages and live chat. In this article we explain how these attacks work and how organisations can prepare.

"We're calling from IT"

Many employees who hear this sentence share their details. The caller really does sound like IT, uses the right internal terms, is in a hurry and is convincing.

According to a CrowdStrike report published at the end of April 2026, two cybercrime groups called Cordial Spider and Snarky Spider do exactly this. Posing as IT support on the phone, they send employees to fake pages that imitate the company's single sign-on (SSO) page, capture session details and register their own MFA devices. The report says one of the groups began exfiltrating data in under an hour.

The phone works better than email

According to Verizon's 2026 Data Breach Investigations Report, social engineering by phone and text message is 40 percent more successful than phishing by email.

The report describes a recurring pattern:

1. First, the employee's inbox is flooded with spam.
2. This creates a realistic "IT emergency".
3. Then someone impersonates the help desk by phone or Teams and asks for remote desktop access "to fix the problem".

No malicious code, no suspicious link. Nothing for technical systems to detect.

Personal phones and the passkey pretext

According to findings published by Google's threat intelligence team in summer 2026, one attacker group calls employees on their personal phones instead of company lines. In some cases they even managed to spoof the real help desk's number.

The scenario is usually the same: "You need to set up a passkey for an urgent security update." When the employee enters their details on the page they are sent to, both the password and the session are stolen instantly. Recently the group has focused on the finance and legal sectors, especially companies going through a merger or acquisition.

Live chat: a new trap that feels safe

In a campaign identified by Cofense researchers, attackers used live chat instead of email:

1. An email that appears to come from PayPal: "You are entitled to a $200 refund."
2. When the user clicks the button, a chat window opens that looks like a real customer support screen.
3. The "support agent" asks for account details to process the refund.
4. An MFA code arrives on the user's phone, and the agent asks for that too.
5. Then billing details, date of birth and card number are requested "for verification".

Because live chat is real-time and personal, it puts people at ease. MFA did not stop this attack, because the user handed over the code themselves.

Why technical measures fall short

A failed attack on senior executives of the security firm Outpost24 in March 2026 shows that even layered defences may not stop an attack that reaches the user. It used an email with a valid DKIM signature, redirection through trusted infrastructure, a re-registered domain with a clean history and a page that blocked automated scanners. In the final step, the target was asked to enter their Microsoft account details.

If an attack reaches the user even at an organisation with this many safeguards, the last line of defence is the user's awareness.

How should organisations prepare?

1. Teach everyone the golden rule: real IT departments never call users to ask for a password or MFA code. This rule should have no exceptions.
2. Call-back procedure: if a call claiming to be from IT seems suspicious, the employee should hang up and call the known help desk number.
3. Protect the help desk too: attackers can call the help desk pretending to be an employee and ask for an MFA reset. Identity verification procedures should work in both directions.
4. Take simulations beyond email: if your awareness programme is still built only around email, employees will be unprepared for the fastest-growing attack channel. Voice and SMS scenarios should be part of the programme.
5. Cover personal phones: explain that employees also need to be careful with "work" calls to their personal numbers.

Frequently asked questions

---
InfoLore's targeted simulations cover phone and SMS scenarios as well as email. Get in touch to measure how ready your organisation is for help desk impersonation.