Researchers spotted a Telegram job ad recruiting callers to impersonate the “Google Account Security Team” and run voice-phishing calls. The ad absurdly claimed “NO SCRIPT READING” while also publishing the exact phone script to use, showing a repeatable, real-world vishing workflow.
A Telegram recruiter posted a job ad seeking callers to run a voice-phishing operation impersonating the Google Account Security Team. The ad tried to insist on improvisation by stating "NO SCRIPT READING," yet it then printed the exact script recruits were expected to use. That script opened with a formal, official-sounding line: the caller identifies themselves, claims to represent the Google Account Security Team, states the call is on a recorded line, and asks the target to confirm their identity by name before the conversation continues.
The ad also specified that applicants should sound like they are from the USA or Canada and be "white sounding," suggesting the operation cared about voice and accent profiling as part of making the call sound credible to targets.
The script leans on formality and procedural language to create a false sense of legitimacy. Phrases like "on a recorded line" mimic the tone of real corporate security or compliance calls, which can lower a target's guard even though nothing about that phrasing actually proves the caller is legitimate. Asking the target to confirm their own identity before the caller has proven anything also flips the normal verification process, making the target feel like they are the one being vetted rather than the other way around.
This kind of attack also succeeds because it targets a wide audience: anyone with a Google account is a potential victim, and the pretext of an account security issue is broadly believable and urgent-sounding.
Organizations and individuals should treat unsolicited security-related phone calls with the same skepticism as suspicious emails. If a caller claims to represent a known company's security team, hang up and contact that company through an official, independently verified channel rather than continuing the call or calling back a number the caller provides.
Security awareness programs should expand beyond email phishing to include voice phishing scenarios, since voice phishing has become a significant method for attackers to gain initial access. Training that includes real call scripts, like the one exposed in this ad, can help employees recognize the specific phrasing and pressure tactics used in these calls before they cause harm.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It's a voice-phishing operation where callers impersonate the Google Account Security Team using a scripted opening line to convince targets they are speaking with a legitimate representative.
Researchers found a Telegram job ad recruiting callers for the scam. The ad claimed 'NO SCRIPT READING' but then published the exact call script to use.
The ad's targeting criteria implies accent and voice profiling was used to increase the likelihood that targets would trust the caller as a legitimate Google representative.
According to Google, voice phishing surged to become the second most common method cybercriminals use to gain initial access, making it a growing concern beyond email-based phishing.
Imagine this call: “Good afternoon, this is Alex from the Google Account Security Team on a recorded line…” Researchers found a Telegram ad recruiting callers to fake that exact Google Security intro, “NO SCRIPT READING”… right next to the full script. Here’s the play: they sound formal, drop “on a recorded line,” then ask, “Am I speaking with…?” before proving anything. That’s compliance theatre, not security. If anyone calls saying they’re Google security, hang up and check your account yourself at myaccount.google.com or the Google app, never by staying on that call.
The FBI says scammers posing as law enforcement or government officials stole over $1.6B since January 2025, mainly by calling victims and threatening arrest, fines, or legal trouble unless they pay. Variants include jury-duty threats, targeted calls to medical professionals about license issues,…
A group of young scammers stole more than $240 million in bitcoin by calling a wealthy crypto investor and impersonating trusted companies. The callers claimed the victim’s accounts and wallet were under attack, then tricked him into granting access and sharing security codes that enabled the…
This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in…
The FBI warns about phone scams where callers impersonate police or federal agents and threaten arrest unless the victim pays immediately. The scams use pressure tactics (keeping victims on the phone, urging secrecy) and push hard-to-trace payments like prepaid cards, crypto, wire transfers, or…
An alleged North Korean operation called “WaterPlum” targeted job seekers by posing as AI and blockchain companies and using the interview process to trick applicants into downloading malicious files. Authorities say the campaign infected tens of thousands of devices worldwide and led to theft from…
A Singaporean man, Malone Lam (aliases including “Anne Hathaway”), pleaded guilty to leading a group that stole over $245 million in cryptocurrency from U.S. victims. The group used social engineering, such as posing as Google Support and using spoofed phone numbers, to trick victims into handing…
