Not every phish arrives as an email. MITRE T1566.004, Spearphishing Voice, is initial access through a phone call or other voice contact. It applies to Windows, Linux, macOS and identity providers.
How attackers use it
The caller manipulates a user into providing access, often by posing as a trusted source and creating urgency or alarm. MITRE notes that a victim may receive a message telling them to call a number, and on that call be directed to visit a malicious URL, download malware or install remote management tools. Voice phishing can also be paired with MFA request generation, where the user is talked into approving prompts or giving up MFA codes.
How to detect it
Detection means joining phone activity to what happened on the computer afterward:
- Call logs from corporate devices for unusual or repeated numbers.
- VoIP or SIP logs for suspicious outbound calls or call setup to unusual endpoints.
- FaceTime, iMessage or SIP client logs on macOS.
- Browser navigation, package installs or remote management tool installs shortly after a call.
- MFA push fatigue or unusual consent grants that line up with call activity.
How to reduce the risk
MITRE lists user training: teach people to recognize and report social engineering, and to be suspicious of callers and verify who they are. Make the verification step concrete, such as hanging up and calling back on a number from the company directory, and tell staff that an unexpected MFA prompt after a call is a reason to report.
Quick check
Which events should you correlate with a suspicious call?
Browser downloads, remote management tool installs and unusual MFA prompts or consent grants that happen soon after the call.
