Levi Strauss reported that an unauthorized party used social-engineering to compromise three employees’ company-issued computers and steal corporate data. Reporting tied the incident to a wider campaign where attackers impersonated IT help desks using spoofed phone numbers and fraudulent websites to capture employee passwords and two-factor authentication codes. The company says customer data was not affected and the investigation is ongoing.
Levi Strauss reported that an unauthorized party used social engineering to compromise three employees' company-issued computers and steal corporate data. This incident was connected to a wider campaign in which attackers impersonated IT help desks, using spoofed phone numbers and fraudulent websites to obtain employee passwords and two-factor authentication (2FA) codes. According to reporting, attackers built customized phishing infrastructure and targeted more than 200 organizations in roughly five weeks, suggesting a repeatable, scaled operation rather than a one-off attempt.
The core mechanism was simple but effective: a phone call posing as internal IT support, paired with a fraudulent website designed to look like a legitimate login or verification portal. Employees who answered the call and followed the instructions were guided to enter their credentials and 2FA codes, giving attackers the access they needed.
This approach worked because it exploited trust in a familiar, low-friction interaction: a support call about an account issue. Spoofed caller ID numbers made the calls appear legitimate, and the fraudulent websites were built to mimic real verification flows closely enough to pass a quick glance. Once an employee is compromised, an attacker may be able to operate through legitimate accounts, making malicious activity harder to distinguish from normal use.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Levi Strauss said an attacker used social engineering to access three employees' company computers and steal corporate data, tied to a broader campaign impersonating IT help desks.
Reuters and Google described a campaign using fake IT help desk identities, spoofed phone numbers, and fraudulent websites to capture employee passwords and two-factor authentication codes.
Levi Strauss stated that customer data was not affected, and the company contained the access, opened an investigation, and hired outside cybersecurity experts.
Attackers reportedly built customized phishing infrastructure and targeted more than 200 organizations in roughly five weeks.
Levi’s breach started with three employees answering one thing: a fake IT help desk call. The script sounds legit: “Hi, this is the IT help desk, there’s an access issue on your account, I just need to verify your login and 2FA code.” The number even looks internal, but Google found these callers were using spoofed phone numbers and fake IT identities across more than 200 companies. Here’s the trap: while you’re on the call, they text or email you a link to an 'IT Support Verification Portal'. The page looks like our single sign-on, but the URL is slightly off. You type your username, password, then your 2FA code, and their fraudulent website quietly captures everything. Here’s your move: if you ever get an unexpected IT help desk call asking for a login or 2FA, hang up and contact IT using our official channel yourself, if it’s real, they’ll already know what you’re talking about.
A phone-first extortion campaign targeted dozens of major U.S. financial firms by calling employees and posing as corporate help-desk staff. Victims were pushed to “update” passkeys/MFA and sent to fake login pages; attackers captured passwords and MFA codes in real time to take over accounts and…
A criminal group tracked as UNC6671 called employees while pretending to be their company IT helpdesk, creating urgency around “mandatory” security changes. Victims were directed to lookalike login pages to “enable passkeys” or “update MFA,” allowing attackers to steal passwords and capture…
A ransom-focused hacking group targeted major U.S. financial and other firms by calling employees on their personal phones while impersonating the company help desk. Victims were pushed to “update passkeys or multifactor authentication” and sent to look‑alike websites designed to steal passwords…
Levi Strauss disclosed a breach after attackers used social engineering to access three employees’ work computers and steal some corporate data. Separately, reporting and Google’s tracking describe a broader campaign where criminals call employees while posing as coworkers or IT, then send them to…
The roundup describes real social-engineering incidents: a phishing email that led an employee to enter credentials on a fake Microsoft 365 login page, and a wave of voice-phishing attempts against major hedge funds using voice-mimicking technology. Both incidents show practical lures that can be…
The article describes real-world ways attackers get around multifactor authentication (MFA), including “push bombing” (MFA fatigue), phishing pages that relay codes in real time, SIM swapping, and stealing session cookies so MFA isn’t needed again. It also cites known incidents (e.g., Uber 2022 MFA…
