Canada’s Cyber Centre Warns of Help Desk Vishing Campaign Targeting Organizations

Summary

Canada’s Cyber Centre warns that vishers impersonate IT staff and relay credentials and MFA responses through lookalike sign-in pages. The actor has reportedly used authenticated sessions to access Microsoft 365 and SaaS data; the alert recommends phishing-resistant MFA

Key points

The Cyber Centre reports ongoing targeting of Canadian organizations, including legal and financial firms; activity has increasingly focused on those sectors since July 2026.
Callers impersonate IT or help desk staff and request urgent passkey, MFA or password changes, sometimes spoofing help desk numbers or contacting employees through Microsoft Teams.
Lookalike sign-in pages relay credentials and MFA responses to legitimate identity providers, bypassing conventional MFA and giving the actor an authenticated session.
Post-compromise activity has reportedly included registering attacker-controlled MFA methods, deleting security notifications, and using scripts and Microsoft Graph to access and exfiltrate Microsoft 365 and connected SaaS data.
The alert recommends phishing-resistant MFA, managed-device and sign-in restrictions, stronger verification for account changes, and monitoring for suspicious MFA registrations and file access.
If compromise is suspected, revoke sessions and tokens, reset credentials, remove unauthorized MFA methods, review activity, and preserve identity-provider and Microsoft 365 audit logs.

Article Details

Defense Focus: Detect and disrupt help desk voice-phishing and adversary-in-the-middle sign-in activity, and limit and investigate unauthorized access to organizational accounts and Microsoft 365 data.
Detection Methods: Monitor for suspicious MFA method or device registrations.
Identify scripted or high-volume access to Microsoft 365 files.
Monitor for deletion of security-related email notifications.
Watch for newly registered domains impersonating the organization.
Review mailbox and file activity when compromise is suspected.
Data Sources: Identity provider audit logs
Microsoft 365 audit logs
Mailbox activity
File-access activity
MFA registration events
Domain registration information
Platforms: Identity providers
Cloud SaaS applications
Defensive Actions: Deploy phishing-resistant MFA, such as FIDO2 security keys, device-bound passkeys, or platform authenticators, especially for privileged and high-risk users.
Require managed devices through conditional access and restrict sign-ins from commercial VPNs, hosting providers, and residential proxies.
Strengthen verification for MFA resets, account recovery, and new device enrollment; reduce session lifetimes.
Train employees to independently verify unexpected IT calls requesting MFA, passkey, or password changes, regardless of caller ID or urgency.
Provide a clear channel for reporting suspicious calls and associated websites.
If compromise is suspected, revoke active sessions and tokens, reset credentials, remove unauthorized MFA methods or devices, and review mailbox and file activity.
Preserve identity provider and Microsoft 365 audit logs for investigation.
Restrict external communications in collaboration platforms to trusted or operationally required users, and regularly review guest access and permissions.