As cited
Copy frozen at (site build).
threat intel
AL26-028 – Ongoing Help Desk Voice Phishing Campaign Targeting Canadian Organizations
The Canadian Centre for Cyber Security reports an ongoing voice phishing campaign targeting Canadian legal and financial organizations since January 2026, with activity concentrating on the legal sector in October. Attackers impersonate help desk staff to direct employees to fraudulent sign-in pages that relay credentials and multifactor authentication (MFA) responses in real time, bypassing conventional MFA protections. After gaining authenticated sessions, the threat actor registers attacker-controlled MFA methods, exfiltrates data from Microsoft 365 and connected applications, and sends extortion demands.
Why it matters: Legal and financial professionals and their IT teams face active targeting by financially motivated actors capable of bypassing standard MFA and establishing persistent access to sensitive data and email systems; deploy phishing-resistant authentication such as FIDO2 security keys, enforce conditional access policies, strengthen MFA reset verification, and train staff to independently verify unexpected IT requests.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
AL26-028: Ongoing Help Desk Voice Phishing Campaign Targeting Canadian Organizations
The Canadian Centre for Cyber Security reports an ongoing voice phishing campaign targeting Canadian legal and financial organizations since January 2026, with activity concentrating on the legal sector in October. Attackers impersonate help desk staff to direct employees to fraudulent sign-in pages that relay credentials and multifactor authentication (MFA) responses in real time, bypassing conventional MFA protections. After gaining authenticated sessions, the threat actor registers attacker-controlled MFA methods, exfiltrates data from Microsoft 365 and connected applications, and sends extortion demands.
Why it matters: Legal and financial professionals and their IT teams face active targeting by financially motivated actors capable of bypassing standard MFA and establishing persistent access to sensitive data and email systems; deploy phishing-resistant authentication such as FIDO2 security keys, enforce conditional access policies, strengthen MFA reset verification, and train staff to independently verify unexpected IT requests.
- Source published
- First seen by Cybersecurity Tracker