FBI warns of ongoing corporate vishing attacks

Hackers are attempting to steal corporate credentials from US-based employees using voice phishing

Vishing alert on a smartphone

The FBI has issued a warning of continuing vishing attacks attempting to steal employees’ corporate network credentials. 

Vishing (also known as voice phishing) is where hackers make VoIP calls to victims to trick them into logging onto a phishing webpage so they can capture the employee’s username and password.

According to an FBI Private Industry Notification (PIN), threat actors are using VoIP access to exploit employees working from home. Many of these employees use VoIP networks to take company phone calls, making them easy targets for cyber criminals.

"During COVID-19 shelter-in-place and social distancing orders, many companies had to quickly adapt to changing environments and technology," the PIN read. "With these restrictions, network access and privilege escalation may not be fully monitored."

According to the PIN, as organizations implement more tools to automate services on their networks, the ability to keep track of who has access to different points on the network and what type of access they have, will become more difficult to regulate.

Related Resource

A buyer’s guide for cloud-based phone solutions

Finding the right phone system for your modern business

How to choose a cloud-based phone solution - whitepaper from AircallDownload now

The FBI said as of last month, cyber criminals collaborated to target US-based and international employees’ at large companies using social engineering techniques. These attacks led to hackers gaining extensive access to corporate networks.

“After gaining access to the network, many cybercriminals found they had greater network access, including the ability to escalate privileges of the compromised employees’ accounts, thus allowing them to gain further access into the network often causing significant financial damage,” read the PIN.

In one instance, cyber criminals found an employee via the company’s chatroom and convinced them to log into a fake VPN page. The actors used these credentials to log into the company’s VPN and perform reconnaissance to locate someone with higher privileges.

“The cybercriminals were looking for employees who could perform username and e-mail changes and found an employee through a cloud-based payroll service. The cybercriminals used a chatroom messaging service to contact and phish this employee’s login credentials,” the FBI said in the PIN.

The FBI urged organizations to protect themselves from such attacks by implementing multi-factor authentication (MFA) to minimize the chance of a compromise. The FBI also recommended granting network access on a least privilege scale — giving the user only the access they need to complete their job — when hiring new employees. 

Featured Resources

B2B under quarantine

Key B2C e-commerce features B2B need to adopt to survive

Download now

The top three IT pains of the new reality and how to solve them

Driving more resiliency with unified operations and service management

Download now

The five essentials from your endpoint security partner

Empower your MSP business to operate efficiently

Download now

How fashion retailers are redesigning their digital future

Fashion retail guide

Download now

Recommended

Colonial Pipeline hack spurred copycat attacks on other oil and gas companies
hacking

Colonial Pipeline hack spurred copycat attacks on other oil and gas companies

29 Jul 2021
Dark web ads offering access to corporate networks increase sevenfold
hacking

Dark web ads offering access to corporate networks increase sevenfold

28 Jul 2021
Number of hacking tools increasing as cyber criminals become more organized
hacking

Number of hacking tools increasing as cyber criminals become more organized

28 Jul 2021
Most employees put their workplace at risk by taking cyber security shortcuts
cyber security

Most employees put their workplace at risk by taking cyber security shortcuts

27 Jul 2021

Most Popular

The benefits of workload optimisation
Sponsored

The benefits of workload optimisation

16 Jul 2021
RMIT to be first Australian university to implement AWS supercomputing facility
high-performance computing (HPC)

RMIT to be first Australian university to implement AWS supercomputing facility

28 Jul 2021
Samsung Galaxy S21 5G review: A rose-tinted experience
Mobile Phones

Samsung Galaxy S21 5G review: A rose-tinted experience

14 Jul 2021