Attackers Impersonate Top Brands in Callback Phishing

Cisco Talos observed a surge in telephone-oriented attack delivery (TOAD) campaigns that impersonate brands such as Microsoft, PayPal, DocuSign, Norton and Best Buy to trick recipients into calling attacker-controlled VoIP numbers. Attackers use PDFs, fake transaction receipts, QR codes and other brand-impersonation lures to prompt callbacks; live voice interaction enables advanced social engineering to harvest credentials or enable malware installation. The report notes VoIP number reuse across days and global distribution of these campaigns, and recommends adding impersonation-detection engines to email security stacks and prioritizing technical controls alongside targeted user training.