- Vishing crews call employees, often on personal mobile phones, posing as the IT helpdesk, and relay the employee's login and MFA codes to attackers in real time.
- Google tracked $10.69 million paid into one group's wallets in about four months. Ransom demands typically start at $1 million to $3 million.
- In some cases the attackers spoofed the company's real helpdesk number, so the call looked internal.
- Cisco Talos reports helpdesk-impersonation calls across its third-quarter 2026 incident cases, including one that ended in ransomware, and found phishing behind 37% of engagements.
How the attack works
An employee receives a call from someone who says they work for the company’s IT helpdesk. There is an urgent mandate: enroll a new passkey, or update multi-factor authentication. The caller directs the employee to a page that looks exactly like the company’s sign-in portal. While the employee types, a second operator relays the password and the MFA approval to the real portal and takes over the session.
Two research teams have documented this in detail this year:
- Okta (July 28) published a tour of “Work Panel,” a criminal platform that packages the whole operation. Callers dial targets from a softphone using SIP credentials the platform assigns. A manager watches a live queue of victims and pushes the next authentication prompt to each one during the call. Sign-in pages are cloned from Okta, Microsoft 365, or Salesforce, and new campaigns launch in minutes. Targets’ direct phone numbers are bought from a commercial contact-data service.
- Google Threat Intelligence (August 7) reported on UNC6671, a group running vishing-based extortion against manufacturing, healthcare, technology, and, most recently, financial and legal firms. Its callers phone employees on their personal mobile numbers, outside corporate controls, and in some recent cases spoofed the company’s legitimate helpdesk number.
The latest evidence
On October 29, 2026, Cisco Talos published its incident response trends for the third quarter. Talos saw several threat actors running voice phishing alongside IT helpdesk impersonation to talk victims into opening a remote session with a legitimate remote-management tool. In one engagement, a caller persuaded a user to start a Microsoft Quick Assist session, and the intrusion ended in VYPR ransomware after data was taken over several days.
- Phishing was the most common way in, appearing in 37% of Talos engagements.
- Missing or weak multi-factor authentication appeared in 33% of engagements, and ransomware or pre-ransomware activity in 27%, the highest share in a year.
- Little preparation was needed. Talos told Help Net Security the attackers appeared to know only employee names and email addresses.
Talos recommends restricting self-service MFA enrollment by requiring helpdesk verification, and moving from push and SMS codes to phishing-resistant methods.
What it costs
One phone call, one extortion demand. Google traced 141.65 bitcoin, about $10.69 million, into 18 wallets linked to one of the group’s brands between January 7 and May 12, 2026. Initial demands typically ran from $1 million to more than $3 million, and in over half of the tracked cases, final payments averaged $750,000.
After taking over a session, the attackers used automated scripts to pull data from cloud platforms and deleted the alert emails that would have warned the employee.
Why security teams miss the call
Every control a security team relies on sees the attack only after the call has succeeded. Email security never sees a message. Endpoint tools see a normal browser. Identity logs record a legitimate-looking MFA enrollment by the real employee. The call itself happens on a phone network the security team does not monitor, often on a personal device.
Both research teams recommend phishing-resistant authentication, such as passkeys and security keys, as the primary defense, together with clear ways for employees to verify that the helpdesk is really calling. That is necessary, but it leaves a question security leaders cannot answer from their own tools: is someone using our numbers, or our name, to call our people right now?
The same kind of telephony infrastructure runs other attacks, from hijacked phone systems to AI voice agents that place scam calls without a human caller.
Questions to answer now
Security and IT leaders should be able to answer the following with confidence:
| # | Question for your leadership team | When |
|---|---|---|
| 1 | Would we know if our helpdesk or main numbers were being spoofed in calls to our employees? | Now |
| 2 | Can an employee verify a helpdesk call in a way an attacker cannot imitate? | Now |
| 3 | Can our security team connect a suspicious call to an MFA or sign-in event in its logs? | This quarter |
| 4 | Which of our people are most likely to be called, and do they know what the helpdesk will never ask? | This quarter |
Answering these questions takes visibility into the phone channel. The VoiceAlerts team can show you how your numbers and brand are used across the U.S. voice network in a free 30-minute briefing.
Key dates
| Date | Milestone |
|---|---|
| Jan 7 to May 12, 2026 | $10.69 million paid into wallets linked to one UNC6671 brand. |
| Jul 28, 2026 | Okta publishes its research on the Work Panel vishing platform. |
| Aug 7, 2026 | Google Threat Intelligence reports UNC6671’s shift to financial and legal targets. |
| Oct 29, 2026 | Cisco Talos reports helpdesk-impersonation vishing across its Q3 incident response cases. |
How VoiceAlerts helps
VoiceAlerts monitors how your numbers, including your helpdesk lines, are spoofed and used across the U.S. voice network, and gives your security team alerts it can match to its own identity logs.
- Spoofing of your helpdesk and main numbers
- Call patterns that signal an active campaign
- Alerts your SOC can match to identity events
Common questions
What is helpdesk vishing?
Helpdesk vishing is a voice phishing attack in which a caller poses as a company's IT helpdesk and persuades an employee to enter credentials on a fake sign-in page, approve an MFA prompt, or open a remote-access session.
How much has helpdesk vishing cost companies?
Google Threat Intelligence traced about $10.69 million into wallets linked to one UNC6671 brand between January 7 and May 12, 2026, with initial extortion demands typically between $1 million and more than $3 million.
Why don't security tools catch vishing calls?
The attack happens on the phone, often on an employee's personal mobile. Email security sees no message, endpoint tools see a normal browser or remote-support session, and identity logs record what looks like the real employee's activity.
How can VoiceAlerts help against helpdesk vishing?
VoiceAlerts monitors how an organization's numbers, including helpdesk lines, are spoofed and used across the U.S. voice network, and gives the security team alerts it can match to sign-in and MFA events in its own logs.
Sources
- blog.talosintelligence.comCisco Talos: IR trends Q3 2026, actors impersonate IT help desks in vishing attacks as ransomware activity increasesOctober 29, 2026
- helpnetsecurity.comHelp Net Security: Fake IT help desk callers got by on little more than names and email addressesOctober 30, 2026
- okta.comOkta Threat Intelligence: Behind the scenes of a vishing operation (Work Panel)July 28, 2026
- cloud.google.comGoogle Threat Intelligence Group: UNC6671 Rebrands, Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud EnvironmentsAugust 7, 2026
- cybersecuritynews.comCybersecurity News: Inside the Cybercrime Platform That Turns Helpdesk Calls Into Enterprise Account TakeoversJuly 30, 2026
- cybersecuritynews.comCybersecurity News: UNC6671 Automates Microsoft 365 Data Theft After Hijacking Employee SessionsAugust 7, 2026
This article is for general information and is not legal advice. Proposed rules can change before adoption; check the FCC record for the final text.
