Corporate Cybersecurity at Risk as Vishing Attacks Surge, Google Warns

The success of these campaigns shows that vishing remains a major threat vector, and organizations must prioritize user training and robust security measures to protect against these sophisticated social engineering attacks.

Google has reported a growing threat from a cybercrime group using vishing (voice phishing) techniques to target corporate data. The group, identified as UNC3944, also known by aliases like 0kptapus or Scattered Spider, has been active since at least 2022. It primarily targets large enterprises through sophisticated social engineering attacks, exploiting voice calls and SMS messages to trick employees into revealing login credentials, especially for identity platforms like Okta.

According to Google’s Mandiant threat intelligence unit, UNC3944 typically impersonates IT or helpdesk personnel to manipulate victims into granting remote access or installing remote monitoring software like AnyDesk. Once access is achieved, the attackers escalate privileges within the network, often leveraging legitimate remote management tools to remain undetected. Their end goal is often data theft, extortion, or facilitating further breaches.

Notably, the group has demonstrated strong technical capabilities, including bypassing multi-factor authentication (MFA), using SIM swapping, and exploiting vulnerabilities in identity and access management systems. They are also known to coordinate across multiple threat actor groups and display persistence and adaptability in their tactics.

Google warns that such attacks are increasing in frequency and sophistication, posing a significant risk to corporate environments, particularly those with distributed workforces or inadequate cybersecurity training. The company urges organizations to adopt enhanced security measures such as phishing-resistant MFA, employee training, and endpoint detection tools to defend against such threats.

The report underscores the evolving nature of cyber threats and the importance of proactive defense strategies to protect sensitive corporate data.