Vishing & smishing

Vishing (voice phishing) and smishing (SMS) exploit channels with fewer technical filters and more emotional pressure than email. Help desks and phone support are recurring targets precisely because their job is to “help”.

Vishing (voice)

Typical pretext   "I'm from IT and need to verify your access" / "I'm from the bank, we detected fraud"
Lever             authority + urgency + fear; the human voice builds trust and pressure
Goals             credentials, dictated MFA/OTP code, password reset at the help desk,
                  approving an MFA push ("MFA fatigue"), installing "remote support"
Technique         caller ID spoofing to imitate an internal/official number

Help-desk attack (heavily used by real groups)

1. OSINT: employee name, their manager, internal jargon, IT provider
2. call the help desk posing as the employee ("I lost my phone/laptop")
3. request a password reset and/or re-enroll MFA on an attacker device
4. with credentials + controlled MFA -> access. (Scattered Spider: MGM/Caesars 2023)

Smishing (SMS) and quishing (QR)

SMS      "package held: pay fee here", "bank alert", shortened link
          -> no verifiable sender, links hard to inspect on mobile
Quishing  QR in SMS/poster/email -> leads to a phishing landing outside the mail filter
Goal      credentials on a mobile landing, malicious app install, fraudulent payment

Execution (authorized engagement)

- prepared call script with branches ("what if they ask for verification?"), authorized spoofed number
- SMS/voice platform only within scope; recording/consent per local law
- clear goals and limits (no coercion, no real sensitive data of the victim)

Defense (blue team)

Out-of-band verification and strict help-desk procedures for resets and MFA re-enroll (callback to an official number, robust identity validation).
Phishing-resistant MFA (FIDO2) and number-matching/limiting retries against MFA fatigue.
Specific training for support/reception; warn employees about caller ID spoofing.
SMS filtering and awareness about unknown QR codes; never dictate OTP codes.

Real-world cases

Twitter (2020): employee vishing → internal panel → hijacking of high-profile accounts.
MGM Resorts / Caesars (2023): Scattered Spider used help-desk vishing to re-enroll MFA; massive disruption and ransom.
Banking and parcel smishing: persistent mass campaigns across Europe.

Testing checklist

Authorization and scope (numbers, limits, recording consent)
OSINT of the target and the help-desk process
Script with branches and an authority/urgency pretext
Caller ID / platform within authorized scope
Defined goal (credential, OTP, reset, push)
Evidence without retaining unnecessary personal data
Report: process weaknesses, don’t blame the employee