FBI and CISA warn of an ongoing voice phishing campaign targeting remote workers in the US aimed at stealing login credentials for corporate networks/VPNs

The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) on Thursday issued a joint alert …

Krebs on Security 2020-08-22 Brian Krebs

Context & Ripple Effects

This joint FBI-CISA alert extends a warning pattern the two agencies have run for years: back in 2016 the FBI tallied $2.3B+ in losses from CEO fraud that impersonated executives over email, and the agency has since kept issuing alerts as the impersonation channel moves. What changed by August 2020 is the target surface — pandemic-era remote work moved corporate access from office networks to home workers logging into VPNs, and the scammers followed.

First-order effects

US remote workers are being socially engineered over the phone into surrendering VPN and network login credentials, meaning any employee with remote access is now an attack entry point rather than just the perimeter.

Second-order effects

The campaign puts pressure on enterprises relying on standard MFA: Cloudflare's experience shows employees fell for an SMS phish but hardware MFA keys stopped the intrusion, giving buyers a concrete argument for phishing-resistant authentication.

Third-order effects

If credential-theft campaigns keep shifting from email to voice and messaging channels, phishing-resistant MFA moves from best practice to procurement baseline, while FBI-CISA joint alerts harden into the standing coordination mechanism seen again in later warnings about Chinese hackers breaching US telecoms and Russian-linked phishing of Signal users.

The trend: Social engineering is migrating from email to voice and messaging channels aimed at distributed workforces, pushing agencies and enterprises toward phishing-resistant authentication as the default defense.

Discussion

@a_greenberg Andy Greenberg on x
The same “phone spear phishing” playbook used to hack Twitter in July has since been used against dozens of other companies, including banks, cryptocurrency exchanges and hosting providers, according to investigators tracking the new wave of attacks: https://www.wired.com/...
@briankrebs @briankrebs on x
The FBI and CISA are warning about the growing threat from voice phishing or “vishing” targeting companies. Their alert comes <24h after my report on a particularly aggressive gang that's marketing a service to steal VPN credentials from company employees https://krebsonsecurity.…
@arekfurt Brian on x
Corporate VPNs should not be using passwords for external access. Full stop. Certificates are free to generate and deploying them to corp devices provides unphishable auth. Security keys allow cross-device use and provide nearly unphishable auth. https://krebsonsecurity.com/ ...
@wired @wired on x
The massive Twitter hack from July has set off a full-blown crime wave https://www.wired.com/...
@a_greenberg Andy Greenberg on x
I've rarely heard threat intelligence people sound as urgent in their warnings about an ongoing hacking campaign as the ones who spoke to me for this story. I hope companies take this threat seriously. https://twitter.com/...

Chronicles