[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1566-004":3},{"item":4,"lessons":18,"controls":68,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1566-004","T1566.004","Spearphishing Voice",12,"MITRE","**What attackers do.** Attackers phone targets, or leave voice messages, pretending to be IT support, a bank or a senior colleague, to persuade them to reveal credentials, approve MFA, install remote access software or call a number back. This Phishing sub-technique, often called vishing, serves Initial Access.\n\n**How to defend.** Set clear verification procedures for helpdesk password and MFA resets, such as callbacks to known numbers or manager approval. Train staff that IT will not ask for passwords or MFA codes, and give them an easy way to report suspicious calls. Restrict which remote access tools can be installed.\n\n**Signs to look for.** Look for helpdesk resets followed by sign-ins from new devices, remote access tool installations soon after a phone call, and MFA method changes. A common gap is that phone calls leave no log, so the first evidence is the follow-on activity.","Adversaries may use voice communications to ultimately gain access to victim systems. Spearphishing voice is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of manipulating a user into providing access to systems through a phone call or other forms of voice communications. Spearphishing frequently involves social engineering techniques, such as posing as a trusted source (ex: Impersonation) and\u002For creating a sense of urgency or alarm for the recipient.\n\nAll forms of phishing are electronically delivered social engineering. In this scenario, adversaries are not directly sending malware to a victim vice relying on User Execution for delivery and execution. For example, victims may receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools (Remote Access Tools) onto their computer.\n\nAdversaries may also combine voice phishing with Multi-Factor Authentication Request Generation in order to trick users into divulging MFA credentials or accepting authentication prompts.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1566\u002F004\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"vishing-token-theft-campaign-targets-executives-via-fake-it-calls","Vishing & Token Theft Campaign Targets Executives via Fake IT Calls","2026-09-07T18:20:45.153+00:00",{"slug":25,"title":26,"published_at":27},"it-impersonation-via-microsoft-teams-fuels-vishing-ransomware-and-oauth-attacks","IT Impersonation via Microsoft Teams Fuels Vishing, Ransomware, and OAuth Attacks","2026-09-03T20:20:56.731+00:00",{"slug":29,"title":30,"published_at":31},"vishing-attacks-exploit-human-trust-to-hijack-microsoft-teams-sessions","Vishing Attacks Exploit Human Trust to Hijack Microsoft Teams Sessions","2026-09-02T18:20:33.972+00:00",{"slug":33,"title":34,"published_at":35},"blackfile-group-exploits-social-engineering-to-extort-financial-firms","BlackFile Group Exploits Social Engineering to Extort Financial Firms","2026-08-17T22:20:57.85+00:00",{"slug":37,"title":38,"published_at":39},"vishing-attacks-exploit-human-trust-to-hijack-saas-credentials-and-mfa","Vishing Attacks Exploit Human Trust to Hijack SaaS Credentials and MFA","2026-08-07T20:21:12.234+00:00",{"slug":41,"title":42,"published_at":43},"vishing-group-unc6671-exploits-employee-trust-to-steal-credentials-and-mfa-tokens","Vishing Group UNC6671 Exploits Employee Trust to Steal Credentials and MFA Tokens","2026-08-07T12:20:19.981+00:00",{"slug":45,"title":46,"published_at":47},"vishing-attacks-on-hedge-funds-social-engineering-leads-to-credential-theft","Vishing Attacks on Hedge Funds: Social Engineering Leads to Credential Theft","2026-08-06T22:20:58.795+00:00",{"slug":49,"title":50,"published_at":51},"fake-it-support-calls-on-teams-deploy-gogrpc-backdoor","Fake IT Support Calls on Teams Deploy GoGRPC Backdoor","2026-07-28T12:22:00.318+00:00",{"slug":53,"title":54,"published_at":55},"vishing-attack-and-weak-credentials-expose-abbott-laboratories-to-dual-breaches","Vishing Attack and Weak Credentials Expose Abbott Laboratories to Dual Breaches","2026-07-17T22:20:44.405+00:00",{"slug":57,"title":58,"published_at":59},"shinyhunters-exploited-oauth-misconfigurations-and-social-engineering-to-steal-salesforce-data-for-a","ShinyHunters Exploited OAuth Misconfigurations and Social Engineering to Steal Salesforce Data for a Year","2026-07-14T08:20:42.603+00:00",{"slug":61,"title":62,"published_at":63},"vishing-attack-tricks-odido-into-granting-access-exposing-62m-customers","Vishing Attack Tricks Odido Into Granting Access, Exposing 6.2M Customers","2026-07-10T18:20:59.526+00:00",{"slug":65,"title":66,"published_at":67},"ai-powered-vishing-platform-automates-voice-based-credential-theft","AI-Powered Vishing Platform Automates Voice-Based Credential Theft","2026-04-16T17:07:58.825+00:00",[69,73,78,83,88,93],{"slug":70,"name":71,"problem":72,"stories":9},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":74,"name":75,"problem":76,"stories":77},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",9,{"slug":79,"name":80,"problem":81,"stories":82},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",7,{"slug":84,"name":85,"problem":86,"stories":87},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",5,{"slug":89,"name":90,"problem":91,"stories":92},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",2,{"slug":94,"name":95,"problem":96,"stories":97},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",1,[99,104,110,116,120,125,131,135],{"family":100,"item":101,"code":102,"title":103,"together":9},"cis","14","Control 14","Security Awareness and Skills Training",{"family":105,"item":106,"code":107,"title":108,"together":109},"nist-800-53","ac-2","AC-2","Account Management",11,{"family":111,"item":112,"code":113,"title":114,"together":115},"gdpr","32","Article 32","Security of processing",10,{"family":100,"item":117,"code":118,"title":119,"together":115},"6","Control 6","Access Control Management",{"family":105,"item":121,"code":122,"title":123,"together":124},"ac-17","AC-17","Remote Access",8,{"family":126,"item":127,"code":128,"title":129,"together":130},"nist-sp","800-63","SP 800-63","SP 800-63: Digital Identity Guidelines",6,{"family":132,"item":133,"code":134,"title":134,"together":87},"itil","overview","ITIL",{"family":100,"item":136,"code":137,"title":138,"together":87},"17","Control 17","Incident Response Management"]