Spearphishing Voice (T1598.004) is a sub-technique of Phishing for Information in the reconnaissance tactic. Its platform is PRE. The channel is the phone.
How attackers use it
MITRE says adversaries use voice communications to elicit sensitive information. These calls can be done manually by adversaries, by hired call centers, or automated through robocalls. This is known as voice phishing, or vishing.
Callers may spoof their phone number while posing as a trusted entity, such as a business partner or technical support staff. They often create urgency or alarm. Impersonation is the core method.
There is a second route called callback phishing. The victim gets a message that tells them to call a phone number, where the adversary tries to collect confidential information.
Adversaries may use earlier reconnaissance, such as searching open websites or victim-owned websites, to tailor a pretext that sounds believable.
How to detect it
MITRE's guidance is to review call logs from corporate devices for patterns of potential voice phishing, such as calls to or from known malicious phone numbers.
Beyond that, your best sensor is the person who took the call. Collect reports of calls that asked for passwords, codes or details about systems, and look for repeated numbers or pretexts across them.
How to reduce the risk
MITRE's mitigation is User Training. Train users to identify and report social engineering and spearphishing attempts, while being suspicious of callers and verifying their identity.
- Make verification routine: hang up and call back on a number you already know.
- Say plainly that no legitimate support person needs a password or a one-time code by phone.
- Treat any message that tells you to call a number as untrusted until verified.
- Give people a simple way to report calls.
Quick check
What is callback phishing?
A message directs the victim to call a phone number, and the adversary collects confidential information on that call.
