ATHR Platform Automates AI-Assisted Voice-Phishing Attacks
Summary
Abnormal researchers say ATHR automates telephone-oriented attack delivery with spoofed lures, AI or human voice operators, and credential harvesting. Advertised on underground forums, it targets services including Google, Microsoft and Coinbase.
Key points
- ATHR combines brand-specific email lures, spoofing, calls routed through Asterisk and WebRTC, and credential harvesting.
- AI voice agents follow scripted recovery scenarios to extract verification codes; operators can instead handle calls themselves.
- Researchers observed support for eight services, including Google, Microsoft, Coinbase and Binance.
- The platform offers per-target customization, real-time attack monitoring and logs of stolen data.
- ATHR was advertised on underground forums for $4,000 plus a 10% commission from profits.
- Abnormal researchers recommend modeling normal communication behavior to detect clusters of similar lures containing phone numbers.
Article Details
- Event Type
- Cybercrime platform automating telephone-oriented attack delivery (TOAD) and voice-phishing campaigns
- Impact
- ATHR reportedly automates brand-specific lure emails, spoofing, calls using AI voice agents or human operators, and credential harvesting. It can solicit account verification codes and provide operators with stolen-data logs. Researchers at Abnormal say the platform lowers the technical barrier to running vishing attacks; the article does not report specific victims or confirmed account compromises.
MITRE ATT&CK
T1566.004 · Spearphishing VoiceATHR reportedly routes victims from lure emails to phone calls for voice-based social engineering, consistent with spearphishing voice.T1656 · ImpersonationATHR's AI agents reportedly mimic support staff, and its emails use spoofing mechanisms to appear to come from trusted senders.