Scammers Use Short-Lived VoIP Numbers and Reuse Windows to Defeat Reputation-Based Blocking

Cisco Talos observed a surge in telephone-oriented attack delivery (TOAD) where attackers embed ephemeral VoIP numbers in email bodies, subjects, and attachments to persuade recipients to call and disclose personal or financial data; operators leverage CPaaS providers (notably Sinch), sequential DID number blocks, rapid provisioning and recycling (median number lifespan ~14 days, 1,962 unique numbers analyzed) to operate large, hard-to-trace scam campaigns that impersonate major brands.