CIS Warns Vishing Threat Is Growing for U.S. State and Local Organizations
Summary
CIS says vishing threatens U.S. SLTT organizations as attackers impersonate help desk staff to obtain credentials or MFA access. AI is lowering barriers to these attacks; CIS recommends stronger identity checks and monitoring for authentication anomalies.
Key points
- CIS observed attacks targeting U.S. SLTT organizations in which callers impersonated help desk staff to seek unauthorized access.
- Attackers may trick help desk employees into resetting passwords or transferring MFA enrollment, or persuade users to reveal one-time passcodes or approve fraudulent MFA prompts.
- Mandiant reported vishing accounted for 11% of initial access in its 2026 M-Trends report, while email phishing fell to 6%; CrowdStrike reported a 442% increase in vishing between the first and second halves of 2024.
- AI-assisted reconnaissance, scripted synthetic speech, and real-time voice transformation can reduce the effort and skill needed to conduct attacks. CIS says voice cloning has not yet been broadly employed.
- CIS recommends stronger caller identity verification and monitoring for unusual authentication locations, new device enrollment, and anomalous MFA activity.
- FIDO2 can prevent credential harvesting after enrollment, but passkey enrollment requests themselves may be targeted and should receive careful scrutiny.
Article Details
- Event Type
- Vishing and social engineering attacks targeting help desk processes and user authentication
- Impact
- Threat actors attempt to gain unauthorized access by impersonating employees or IT support, inducing password resets, MFA enrollment changes, passkey registration, one-time passcode disclosure, or fraudulent MFA approvals. Reported incidents include account compromise, access to downstream environments, customer-record exfiltration, and extortion. U.S. SLTT organizations are assessed to face increased risk.
Threat Actors
Products
FIDO2FIDO2 authentication offers the strongest available prevention, eliminating one-time passcode use by replacing it with device-bound authentication that a vishing caller cannot harvest or relay.Microsoft Entragroup ShinyHunters reportedly used a vishing call to compromise a major telecom company employee's Microsoft Entra account to pivot into the company's Salesforce environment and exfiltrate customer records.Microsoft TeamsSLTT employees using Microsoft Teams while posing as help desk employees.PowerSchoolHowever in December 2024, a threat actor breached K-12 vendor PowerSchool through stolen credentials and later attempted to extort school districts directly using stolen data.Salesforceto compromise a major telecom company employee's Microsoft Entra account to pivot into the company's Salesforce environment and exfiltrate customer records.
Countries
Industries
EducationFinancial ServicesGovernmentofficials in campaigns targeting current and former federal and state government officials since at least April 2025.Physical securityIn April 2026, ShinyHunters reportedly used a vishing call against a widely used physical security firm's employee to access their enterprise account, reported Bleeping Computer in another article, at which point itTelecommunications