Alert - AL26-028 – Ongoing Help Desk Voice Phishing Campaign Targeting Canadian Organizations

Serial number: AV26-028
Date: October 28, 2026

Audience

This Alert is intended for IT professionals and managers.

Purpose

An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.

Details

The Canadian Centre for Cyber Security (Cyber Centre) is aware of an ongoing voice phishing (vishing) campaign targeting Canadian organizations, including organizations in the legal and financial sectors. Multiple Canadian firms have been targeted by individuals impersonating internal IT support and directing employees to fraudulent sign-in pages. The tradecraft and infrastructure are consistent with publicly reported operations by a financially motivated threat actor Footnote 1Footnote 2.

Throughout 2026, this activity has shifted across sectors, increasingly targeting finance and legal organizations since July Footnote 1. The Cyber Centre has identified related infrastructure naming Canadian organizations since January, with October activity concentrated on the legal sector. The campaign bypasses conventional multi-factor authentication (MFA) through real-time relay and frequently rotates lure domains, limiting the effectiveness of blocklists.

Initial Access

  • Help desk voice phishing: Callers impersonate internal IT or help desk staff and claim an urgent passkey migration, MFA enrolment or password change is required. Calls may target personal mobile phones, office phones or Microsoft Teams, and may spoof legitimate help desk numbers. Callers may reference internal IT staff or missed deadlines to add credibility and may end the call if the employee attempts independent verification Footnote 1.
  • Organisation-branded adversary-in-the-middle sign-in pages: The caller directs the employee to an organisation-branded subdomain on a generic root domain designed to mimic an enrolment portal.
    • The targeted organization’s name may appear as a subdomain of a generic domain (e.g., <org-name>.onetimesso[.]com, <org-name>.registermymfa[.]com) or be incorporated directly into a newly registered domain (e.g., <org-name>sso[.]com, <org-name>internal[.]com).
    • Domains commonly combine action words such as "activate", "enroll", "register", "create", "add", "enable", "deploy" or "set" with authentication-related terms such as "passkey", "sso", "mfa" or "2fa". Other commonly used terms include "okta", "internal", "signin", "account", "security", "portal", "setup", "connect" and "sync".
    • The page relays credentials and MFA responses to the legitimate identity provider, providing the actor with an authenticated session Footnote 1Footnote 2.

Post-Compromise Activity

After obtaining an authenticated session, the actor has been reported to Footnote 1Footnote 2:

  • Register attacker-controlled MFA methods or devices to maintain access.
  • Delete password-reset, MFA-change and security notifications, and reset passwords for non-SSO applications.
  • Use automated scripts and Microsoft Graph to access and exfiltrate data from Microsoft 365 and connected SaaS applications, including SharePoint and OneDrive.
  • Send extortion demands following data theft.

Suggested actions

The Cyber Centre recommends that organizations:

  • Deploy phishing-resistant MFA, such as FIDO2 security keys, device-bound passkeys or platform authenticators, particularly for privileged and high-risk users Footnote 3.
  • Enforce conditional access requiring managed devices and restrict sign-ins from commercial VPNs, hosting providers and residential proxies.
  • Strengthen verification for MFA resets, account recovery and new device enrolments, and reduce session lifetimesFootnote 1.
  • Monitor for suspicious MFA registrations, scripted or high-volume Microsoft 365 file access, security-email deletion and newly registered domains impersonating the organization Footnote 2.
  • Instruct employees to independently verify unexpected IT calls requesting MFA, passkey or password changes, regardless of caller ID or urgency Footnote 4.
  • Provide a clear channel for reporting suspicious calls and associated websites.
  • If compromise is suspected, revoke active sessions and tokens, reset credentials, remove unauthorized MFA methods or devices, and review mailbox and file activity.
  • Preserve relevant identity provider and Microsoft 365 audit logs for investigation Footnote 5.
  • Restrict external communications in collaboration platforms (e.g., Microsoft Teams, Webex, Slack, among others), including direct messaging, calls and meeting invitations, to trusted or operationally required external users, and regularly review guest access and permissions.

Organizations should also review the Cyber Centre’s Top 10 IT Security ActionsFootnote 6.

Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal, or email contact@cyber.gc.ca.

References

Date modified: