Cyberpediaby Brain
ENDEFR

Vishing, voice phishing by phone

A fake IT support agent or a fake banker calls you and the screen shows a familiar number: how to recognise vishing and react.

In 30 seconds

Where it happens
By phone, sometimes with a text message at the same time, among employees as well as at the IT help desk4.
What the attacker wants
A password, an authentication code, or the installation of a tool that gives them control of the computer34.
The reflex
Check the caller's identity with the organisation they claim to represent1.
If it has already happened
Tell the organisation's officials straight away, including network administrators, and change any passwords that were revealed1.

What it is

Vishing (voice phishing) is phishing carried out by voice. The attacker phones while posing as a trusted person, to obtain information or an action from the victim. CISA describes it as the social engineering approach that relies on voice communication1.

For an employee, the typical scenario is a call from someone pretending to be legitimate IT staff3.

Straight answers

Does the number shown on the screen prove who is calling?

No. Fraudsters can falsify their number while posing as a trusted entity, such as a business partner or technical support2. CISA states that voice over IP (VoIP) makes it easy to falsify the caller's identity, and that this exploits misplaced trust in the security of telephone services1.

Who does the attacker impersonate?

The sources cited here mention a business partner, a member of technical support2, legitimate IT staff3 and, in some cases, an employee who calls the help desk in place of the real account holder4. Microsoft also describes attackers posing as newly hired employees6.

What are they trying to get?

According to MITRE, the attacker may push the victim to open a malicious address, download malware or install remote management tools that the attacker can then use3. They may also try to obtain multifactor authentication credentials, or to get authentication requests accepted3. One of the groups described by CISA convinced employees to give it their one-time password (OTP), an authentication code4.

Should you be wary of calls received after a message?

Yes. A phishing message can ask the recipient to call a number back: MITRE speaks of «callback phishing» and says the attacker then tries to gather sensitive information2.

What should you do about a suspicious call?

CISA advises being wary of unsolicited calls from people asking about employees or internal information, and verifying the caller's identity directly with the organisation they claim to represent1. It adds that you should not give personal or organisational information unless you are certain the person is entitled to it1.

1Inside the attacker's head1 min

The attacker starts by gathering information. In CISA's advisory on the Scattered Spider group, the attacker first looks on professional sites for the targeted person's role in the company4. They then collect usernames, passwords and personal data4. Their calls, often several in a row, first serve to learn the password reset procedure, then to gather information specific to the targeted employee4. These calls rely on personal data from social media, open sources, commercial intelligence tools and database leaks4.

Microsoft describes the same method: the actor studies the organisation, imitates the tone and vocabulary of the person being impersonated, and knows enough personal information to convince an administrator to reset a password or an authentication method6. This actor commonly targets technical administrators, such as support and help desk staff6.

The attacker does not need to make the call themselves. According to MITRE, calls can be made by the attacker, by call centres hired for the occasion, or automated through prerecorded calls2. In rare cases, Microsoft has seen attackers resort to intimidation, with a home address, names of relatives and physical threats6.

2What you see on screen1 min

You see a number that looks familiar, or a name you think you recognise. Urgency or alarm is part of the scenario: MITRE notes that the attacker presents as a trusted source and creates a sense of urgency3.

What follows varies. A caller may ask you for a one-time authentication code (OTP)4. They may also ask you to approve an authentication notification on your phone: CISA describes notifications sent repeatedly until the employee taps «Accept» (MFA fatigue)4. At other times, they guide you to a fake login portal or ask you to launch a remote access tool54. The text message may contain a link to a fake portal that imitates the company's authentication6.

3Under the hoodIT teams1 min

Remote access tools are legitimate software. Microsoft notes that remote administration tools, misused by the actor it describes, have normal uses and that their use must be monitored in the environment6. MITRE cites examples such as AnyDesk8. MITRE specifies that these tools can be installed and then used after a compromise to establish an interactive remote desktop session8.

Another mechanism is the hijacking of the number itself. CISA reports that Scattered Spider convinced telephone carriers to transfer a user's number to a SIM card in its possession (SIM swap), which gives control of the phone and of authentication requests4. Microsoft also describes setting up call forwarding on an employee's number, followed by a self-service password reset6.

On the defence side, MITRE suggests monitoring the call logs of work devices and correlating them with events that follow the call, such as the installation of a remote management tool3. CISA asks for phishing-resistant multifactor authentication on all services where possible, and for continued training against vishing4.

4Case filesReal cases1 min

Scattered Spider, June to December 2022

MITRE links to campaign C0027, from June to December 2022, calls and text messages in which the attacker posed as IT staff5. Victims were directed to a credential harvesting site or pushed to launch commercial remote management tools5. Once inside, the group searched the victims' documentation spaces for support instructions and for VPN and multifactor authentication enrolment guides5.

Octo Tempest, 2022 and 2023

In its post of 25 October 2023, Microsoft describes a group first seen in early 2022, which initially targeted mobile carriers and outsourcing companies to trigger number transfers6. In 2022, it resold SIM swaps to other criminals and took over the accounts of wealthy individuals to steal their cryptocurrency6. Microsoft notes that it also called an organisation's help desk to get a password reset or an authentication factor added6.

Update to the CISA advisory, July 2025

Advisory AA23-320A, published on 16 November 2023, was updated on 29 July 2025 with more elaborate social engineering techniques4. One of them is posing as an employee to obtain sensitive information from support, a password reset and the transfer of multifactor authentication to a device controlled by the attacker4.

5What you do1 min

Check the caller's identity directly with the organisation they claim to represent1. For a request received by email, CISA recommends not using the contact details from a site linked to the request, but looking for those in earlier communications1. The NCSC advises verifying an important request received by email through a second means of communication, such as a call or an in-person confirmation7.

CISA describes a group that obtained one-time passwords from employees4. If you have already given in, report it without delay to the organisation's officials: they will be able to monitor unusual activity1.

Fact sheet

Identifier
CP-008
Wing
1. Attacks and techniques
Brain skill
Detecting Phishing (detect_phishing)
Brain reflex
cr-019
Diagram
G1 · Attack vs Defense Chain
Languages
de, en, fr
Sources
8 sources checked on 3 November 2026
Sources8 sources
  1. CISA, “Avoiding Social Engineering and Phishing Attacks | CISA”, 1 February 2021. https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks (accessed 3 November 2026)
  2. MITRE ATT&CK, “Phishing for Information: Spearphishing Voice, Sub-technique T1598.004 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1598/004/ (accessed 3 November 2026)
  3. MITRE ATT&CK, “Phishing: Spearphishing Voice, Sub-technique T1566.004 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1566/004/ (accessed 3 November 2026)
  4. CISA, “Scattered Spider | CISA”, 16 November 2023. https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a (accessed 3 November 2026)
  5. MITRE ATT&CK, “Scattered Spider, Roasted 0ktapus, Octo Tempest, Storm-0875, UNC3944, Group G1015 | MITRE ATT&CK®”. https://attack.mitre.org/groups/G1015/ (accessed 3 November 2026)
  6. Microsoft, “Octo Tempest crosses boundaries to facilitate extortion, encryption, and destruction | Microsoft Security Blog”, 25 October 2023. https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/ (accessed 3 November 2026)
  7. NCSC (UK), “Phishing attacks: defending your organisation”, 5 February 2018. https://www.ncsc.gov.uk/guidance/phishing (accessed 3 November 2026)
  8. MITRE ATT&CK, “Remote Access Tools, Technique T1219 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1219/ (accessed 3 November 2026)

Cite this article

Brain, “Vishing, voice phishing by phone”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/vishing-voice-phishing-call-spoofing/

BibTeX 
@misc{brain_cp008_en_2026,
  author = {Brain},
  title = {Vishing, voice phishing by phone},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/vishing-voice-phishing-call-spoofing/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence