This weekly threat bulletin highlights multiple real-world incidents, including a healthcare data breach claim where attackers reportedly used phone-based social engineering (vishing) to compromise identity accounts and access cloud apps. It also describes a large-scale “debt relief” email phishing campaign designed to trick recipients into calling attacker-controlled phone numbers, where the scammers then attempted to harvest personal and financial data.
This breakdown covers two related social engineering patterns described in a recent threat bulletin. In the first, a large-scale phishing campaign used fraudulent debt-relief emails to push recipients toward calling attacker-controlled phone numbers. Once a victim called, the conversation itself became the attack surface: scammers used the call to collect personal and financial information under the guise of helping with debt relief.
In the second pattern, a threat group claimed it used vishing, phone-based social engineering, to compromise Okta identity accounts. Because Okta functions as a single sign-on layer, compromising those accounts gave attackers a path into connected cloud applications such as Salesforce and Snowflake.
Both scenarios work by moving the interaction away from email, where security tools and skepticism are strongest, and into a live phone call, where pressure and trust can be manipulated in real time. The debt-relief pretext relies on a plausible, emotionally relevant topic to get the recipient to make the first move. The Okta-related vishing relies on the caller appearing to be legitimate support, asking the target to verify identity or approve a login prompt in a way that feels routine.
Identity systems make this especially risky. A single compromised SSO account can expose multiple connected tools at once, which is why the reported access reportedly extended beyond the initial account into Salesforce and Snowflake.
Organizations can reduce exposure by training staff to treat unsolicited "call this number" messages as high-risk and to verify such requests through a separately confirmed, trusted channel rather than the number provided in the message. Staff should also be trained to never share MFA codes or approve unexpected login prompts during a phone call, regardless of how confident or official the caller sounds.
Because identity accounts can unlock access to multiple SaaS platforms, limiting what any single account can reach, and applying strong verification steps for helpdesk-style requests, helps contain the impact if a vishing attempt does succeed. Awareness training that specifically covers phone-based pretexts, not just email phishing, is a key part of closing this gap, and can incorporate the MITRE technique referenced for phishing for information (https://attack.mitre.org/techniques/T1598/).
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is an email, such as a fake debt-relief message, that pushes the recipient to call a phone number rather than click a link. Once on the phone, the attacker uses social engineering to collect personal and financial information.
A threat group claimed it used vishing to compromise Okta identity accounts, which were then used to reach connected apps like Salesforce and Snowflake.
Callers can sound like legitimate support staff, create urgency, and ask targets to approve login prompts or share one-time codes in the moment, which bypasses many email-based defenses.
They should not share credentials or approve login prompts on the call, and should instead verify the request through a known, trusted internal channel before taking action.
Imagine this: a phone call helps steal 284 million patient records… and it starts with a single email. McKesson reported attackers used vishing to get into Okta, then into Salesforce and Snowflake. Another campaign sent fake debt‑relief emails just to make people call attacker‑controlled phone numbers. Here’s the trick: the email feels helpful, “call us for debt relief.” The call feels legit, “IT from Okta support, can you verify a code?” But they’re just moving you off email to a phone call to grab your login and MFA. Your move: if an email or caller tells you to share a code or approve a login, hang up and contact IT using our official helpdesk channel, never the phone number or link they gave you.
McKesson disclosed a breach tied to unauthorized access of third-party applications and data theft affecting some customers. The ShinyHunters extortion group claims it used phone-based social engineering (vishing) to steal employee credentials, took over Okta single sign-on accounts, and then…
This bulletin describes multiple real-world social engineering campaigns where attackers trick people into trusting a familiar screen, like a search result “install guide,” a recruiter outreach, or a helpdesk phone call. The lures push victims to paste commands, install fake software, or reset MFA,…
Boston Scientific and McKesson disclosed separate cyber incidents impacting healthcare operations and sensitive data. Boston Scientific’s ongoing attack disrupted remote monitoring for some implanted cardiac devices, while McKesson confirmed unauthorized access to third-party apps tied to specific…
ReliaQuest confirmed an employee was socially engineered into entering their password on a fake SSO page and approving an MFA push, giving attackers a brief “view only” session in the company’s identity dashboard. The attackers allegedly impersonated a named member of the security team over the…
Okta says it gained an inside look at “Work Panel,” a polished SaaS-style dashboard that helps voice-phishing (vishing) crews rapidly set up fake login sites and guide victims through password and MFA capture. The tool clones brand look-and-feel for services like Okta and Microsoft 365, then lets a…
This bulletin highlights multiple real-world threats, including voice-phishing (vishing) operations that industrialize account takeovers and a fake CCleaner download site that installs spyware. The items provide concrete, repeatable lures (a vishing-driven takeover workflow and a lookalike software…
