Vishing and MFA Phishing Attacks

1. Executive Summary

Threat actors are targeting banking clients through coordinated social engineering campaigns that leverage sophisticated voice phishing (vishing), bank impersonation, caller ID spoofing, credential-harvesting websites, and MFA social engineering. These attacks are conducted in real time, allowing threat actors to capture victims’ banking credentials and authentication codes and immediately use them to access legitimate financial accounts and conduct unauthorized transactions.
The FBI has documented similar Account Takeover (ATO) fraud schemes involving the impersonation of financial institution support, demonstrating that this attack methodology represents a broader threat to financial institutions and their customers. Similar TTPs have also been observed across financially motivated threat actors and campaigns, including Scattered Spider and UNC6671, although the available information is insufficient to attribute this activity to a specific threat actor.
DefendEdge can help reduce exposure to these threats through brand and domain impersonation monitoring and takedowns, IOC identification and blocking through iDNA Guard, dark web monitoring for compromised credentials, accounts, and session data, employee security awareness through KnowBe4, and ongoing threat intelligence reporting. These capabilities, combined with strong authentication, fraud detection, customer awareness, and rapid incident response, provide a layered approach to identifying and mitigating account takeover threats.

Attack Breakdown

The attack is conducted in real time, with the threat actor remaining on the phone throughout much or all of the compromise. This activity is consistent with Account Takeover (ATO) fraud documented by the FBI, in which cybercriminals impersonate financial institutions and use social engineering, fraudulent websites, stolen credentials, and MFA/one-time passcodes to gain unauthorized access to financial accounts and steal funds. Below is a breakdown of the attack and associated Tactics, Techniques, and Procedures (TTPs) deployed by the cybercriminal.
Bank Impersonation → Phishing Link → Credential Theft → Legitimate Login Attempt → MFA Theft → Account Takeover → Financial Theft

a) Bank Impersonation and Caller ID Spoofing
The threat actor calls the victim while impersonating a legitimate bank representative. To increase credibility, the attacker may use caller ID spoofing, which manipulates the caller ID information transmitted during the call so that the victim’s phone displays the bank’s name or legitimate phone number. The attacker commonly claims there is suspicious activity, fraud, or another urgent issue requiring immediate action.

TTPs:

• Vishing/voice phishing
• Bank employee impersonation
• Caller ID spoofing
• Pretexting and urgency
• MITRE ATT&CK T1566.004 – Phishing: Spearphishing Voice

b) Phishing Link Delivery

While keeping the victim on the phone, the attacker sends a link to a fraudulent website designed to resemble the bank’s legitimate login portal. The victim is instructed to access the link as part of the supposed verification or fraud-resolution process.

TTPs:

• Phishing link delivery
• Brand and website impersonation
• Credential-harvesting infrastructure
• MITRE ATT&CK T1598.003 – Phishing for Information: Spearphishing Link

c) Credential Capture

When the victim enters their username and password on the phishing site, the attacker captures the credentials. Because the attacker conducts the attack in real time, they can immediately use the credentials against the legitimate banking portal.

TTPs:
•Credential phishing
•Credential harvesting
•MITRE ATT&CK T1056.003 – Input Capture: Web Portal Capture

d) Legitimate Login and MFA Trigger
While still speaking with the victim, the attacker enters the stolen credentials into the real bank website or application. The bank recognizes the credentials and sends the victim a legitimateMFA/one-time verification code.

TTPs:
•Use of stolen credentials
•Authentication to legitimate services
•MITRE ATT&CK T1078 – Valid Accounts

e) MFA Social Engineering
The attacker tells the victim that the legitimate MFA code is required to verify their identity, secure the account, reverse fraudulent activity, or complete another supposed security action. The victim provides the code verbally, and the attacker enters it into the legitimate banking portal.

TTPs:
•MFA/OTP social engineering
•Real-time authentication manipulation
•MITRE ATT&CK T1621 – Multi-Factor Authentication Request Generation

f) Account Takeover and Financial Theft
With both the victim’s credentials and MFA verification, the attacker gains authenticated access tothe account. The attacker can then initiate unauthorized transfers or other financial transactions while keeping the victim engaged on the phone, potentially delaying detection and allowing additional fraudulent activity.

TTPs:

• Financial account takeover
• Abuse of valid credentials and authenticated access
• Unauthorized transfers/financial transactions
• T1078 – Valid Accounts
• T1657 – Financial Theft (Impact)

3. Potential Threat Actor Attribution

The observed activity is consistent with financially motivated cybercriminal groups specializing in vishing, credential phishing, MFA social engineering, and account takeover. Several established threat clusters, including Scattered Spider (UNC3944), UNC6671/BlackFile, and ShinyHunters-associated clusters, demonstrate overlapping TTPs. However, the currently available information is insufficient to attribute the activity to a specific threat actor with confidence.

d) Other Actors Are Possible
While the identified threat actors demonstrate TTPs consistent with the observed activity, other cybercriminal actors or groups may also be responsible. Vishing, bank impersonation, caller ID spoofing, credential harvesting, MFA social engineering, and account takeover are not unique to any single threat actor and are widely used across the cybercriminal ecosystem. The activity could therefore involve dedicated vishing crews, Phishing-as-a-Service (PhaaS) operators or affiliates, account takeover and fraud groups, credential brokers, or other financially motivated actors. Additional technical indicators and infrastructure would be required to narrow potential attribution.

4. Mitigations and Recommendations

A layered approach combining customer awareness, authentication controls, fraud monitoring, and rapid incident response can reduce the likelihood and impact of these attacks.

a) Customer Awareness and Verification:
Clients should be regularly reminded that bank representatives will not request passwords or MFA/OTP codes. Customers receiving suspicious calls should disconnect and independently contact the bank using a verified phone number rather than relying on caller ID or information provided by the caller. Customer-facing communications should specifically address caller ID spoofing, phishing links, and requests for authentication codes.

b) Phishing-Resistant MFA:
Where supported, prioritize phishing-resistant authentication methods such as FIDO/WebAuthn over SMS or traditional OTP-based authentication. These methods can prevent credentials entered into fraudulent websites from being successfully used against legitimate services.

c) Enhanced Authentication and Fraud Detection:
Monitor for anomalous authentication activity, including logins from new devices or locations, unusual login patterns, password or account-recovery changes, and authentication events immediately followed by high-risk financial activity. Additional verification should be considered for high-risk transactions, account changes, or new transfer destinations.

d) Transaction Monitoring:
Monitor for unusual transfers, rapid movement of funds, new recipients, significant deviations from normal customer activity, and other indicators of potential financial fraud. High-risktransactions should trigger additional validation before funds are released.

e) Phishing and Impersonation Monitoring:
Continuously monitor for lookalike domains, fraudulent banking websites, brand impersonation, malicious advertisements, and other infrastructure designed to imitate the organization. Escalate confirmed malicious infrastructure for blocking and takedown as quickly as possible.