Cybercriminals targeting major financial and investment firms are using an old-fashioned technique to bypass modern security systems: calling employees and pretending to be someone they are not.
Google security researchers warned that several groups have been targeting employees at major companies through voice phishing attacks, also known as “vishing”.
The attackers contact employees on their personal mobile phones, impersonate colleagues or IT support staff and attempt to convince them to enter login details or authentication codes into fake websites.
The campaign demonstrates that cybersecurity does not always depend on finding a sophisticated technical vulnerability.
Sometimes, the easiest way into a company is through a person.
According to Google’s findings, the groups targeted large financial and investment organisations with the goal of gaining access to sensitive information and eventually extorting victims.
Reports indicated that the wider campaign affected or targeted major companies across the financial sector.
The attackers reportedly created convincing websites designed specifically for their targets.
During phone calls, they attempted to persuade employees that they needed to complete an urgent security or technical task.
Once the employee entered their credentials or multi-factor authentication codes, attackers could potentially use the information to access company systems.
The method is particularly effective because it combines technology with social engineering.
A fake email can sometimes be identified through poor grammar, suspicious links or an unfamiliar sender.
A convincing phone call can be harder to recognise.
The attacker can respond to questions in real time, create urgency and adapt the conversation depending on how the target reacts.
Google identified several groups involved in the campaign, using names including Falcon, Helix, Pink and Redact.
Some of the groups also operated websites where they publicly threatened victims and attempted to pressure them into paying ransoms.
The attacks are a reminder that multi-factor authentication, while important, is not a complete solution.
Security codes are effective when users know where they should enter them.
But if an attacker can convince a victim to enter that same code into a convincing fake website, the security system can become significantly less effective.
That is why many organisations are increasingly moving towards phishing-resistant authentication methods such as passkeys and hardware security keys.
However, technology alone cannot completely solve the problem.
Employees remain an important part of an organisation’s security.
Companies need clear procedures for how IT teams communicate with staff, particularly when requesting credentials or account-related actions.
One of the simplest protections is establishing a clear rule: legitimate IT staff should never ask employees to reveal passwords or authentication codes.
The latest campaign is also interesting because it shows that cybercrime does not always move in a straight line towards greater technical sophistication.
Artificial intelligence is making phishing emails more convincing and automated attacks more powerful.
Yet attackers are still willing to pick up a phone.
That may be because human trust remains one of the most valuable vulnerabilities available.
An attacker does not need to break an advanced encryption system if they can persuade someone to voluntarily provide access.
For businesses, the lesson is uncomfortable but important.
Cybersecurity training cannot simply focus on suspicious emails.
Employees also need to understand social engineering through phone calls, text messages and fake technical support requests.
As cybercriminals become more organised, they are increasingly combining different methods.
A phone call may lead to a fake website.
A stolen password may lead to a data breach.
The stolen data may then be used to target additional employees.
The entire attack can begin with something that feels completely ordinary: a person answering their phone.
Google’s warning is therefore a reminder that even as cybersecurity enters the age of AI, some of the most effective attacks still depend on one of the oldest tricks in the book.
Convince someone to trust you.
