A Day in the Life of a Prolific Voice Phishing Crew

This investigative report describes a prolific voice-phishing ecosystem that uses rented phishing panels, caller ID spoofing, legitimate vendor support lines (Apple and Google), and data broker breaches to send account prompts, phishing emails, and fake support links to victims; the operators (e.g., “Perm” and “Stotle”) coordinate on Telegram/Discord, have drained high-value targets (including a ~$4.7M crypto theft), and employ automation tools (“autodoxers”) to prioritize wealthy targets and verify exchange accounts.