Vishing examples for security awareness training

Key takeaways

Vishing (voice phishing) is social engineering done live on a call: the attacker phones an employee while posing as IT, an executive or a supplier, or phones the IT service desk while posing as an employee.
The call can come by phone, as a Microsoft Teams call from an outside account named "Help Desk", or as a WhatsApp call or voice message in a cloned executive's voice.
Vishing gets around MFA that relies on codes or push prompts, because the person on the call reads out the code or accepts the prompt.
Clorox's lawsuit against its outsourced service desk alleges an agent reset a caller's password and MFA without verifying identity. The written procedure was right; the suit says it was not followed.
Ending the call and calling back on a number from the internal directory, never one the caller supplies, is the basic control against these calls.

Vishing, or voice phishing, is social engineering done live on a call: the attacker phones an employee while posing as IT, an executive or a supplier, or phones the IT service desk while posing as an employee, and asks for a password reset, an MFA code or remote access.

A call does not pass through an email spam filter, and Google counted about 20 organisations hit by one vishing campaign by June 2025, with no software flaw involved (The Register, Google GTIG). Sophos notes that fake help-desk calls like these are not usually covered in anti-phishing training (Sophos), so they need their own place in awareness training.

How a vishing attack works

Vishing takes five common forms:

Service desk social engineering: the caller, posing as an employee, asks for a password reset or MFA moved to a “new phone” (CISA).
Fake IT support calling staff: the caller gets the employee to read out an MFA code, approve a push, install remote-access software or authorise an app (Google GTIG).
Microsoft Teams calls: the attacker floods the inbox with spam, then calls on Teams as “Help Desk” and talks the user into Microsoft’s Quick Assist remote-control tool (Microsoft).
Callback phishing: an email about a small charge gets the victim to phone the attacker (FBI).
AI voice cloning on mobile: WhatsApp messages from an unknown number, then a call in a voice that can “sound nearly identical” to a known contact (FBI).

The steps

Reconnaissance: names, roles and numbers from company sites and out-of-office replies (Mandiant).
Learn the reset process: attackers often call several times to learn what the service desk asks for, then gather those details for one employee (CISA).
Build the pretext: a forgotten password, a phone broken while travelling, an urgent executive. Caller ID can be spoofed to show the real service-desk number.
Make the ask: a reset, an MFA transfer, a code, a remote session, an app authorisation or a payment.
Use and repeat: one account opens chats and the directory, which feed the next call.

Why it works

It targets people whose job is to help: service-desk agents working through scripts under heavy call volume. The attacker already holds real details: “They appeared as an individual, with their details,” the M&S chairman told MPs about the 2025 impersonation attack (UK Parliament). Codes and push prompts offer no protection when the person on the call hands them over.

How to spot a vishing call

An unexpected call or Teams message from “IT”, especially one tagged “External” or straight after a spam flood.
Any request for an MFA code, a push approval, a remote session, or the code that starts one.
An “executive” on an unfamiliar number or on WhatsApp, pushing for secrecy and speed.
At the service desk: a caller who can’t use self-service, has a “lost phone”, is in a hurry or is senior.

Vishing examples

MGM Resorts (2023, hospitality).

The attackers said they found an employee on LinkedIn and called the service desk (AGBrief). MGM never confirmed this. It did report systems shut down across its hotels and casinos, customer data stolen, and an estimated $100 million hit to its September results (MGM 8-K).

Harvard University (2025, education).

Harvard says that in November 2025 it found an outsider had got into the systems used by its Alumni Affairs and Development office “as a result of a phone-based phishing attack”. It has not said who was called or what they were asked for. The systems held alumni and donor contact details, home addresses and records of donations to the university (Harvard).

Cisco (2022, technology).

The attacker already had an employee’s password, synced to a personal Google account. Over several days, the attacker ran a series of voice phishing calls under the guise of various trusted organisations, with MFA push after push, until the employee accepted one and the attacker got onto the VPN. Cisco Talos linked the attacker to the Lapsus$ group and the Yanluowang ransomware gang; no ransomware was deployed (Cisco Talos).

The Salesforce vishing wave (2025, multi-sector).

Callers posing as IT support talked employees into approving a modified version of Salesforce’s Data Loader app, sometimes renamed “My Ticket Portal”, then exported customer data and demanded payment. Google counted about 20 victims by June 2025 (The Register), and one of Google’s own instances was hit too. No Salesforce flaw was involved (Google GTIG).

Clorox (2023, consumer goods manufacturing).

According to Clorox’s lawsuit against its outsourced service desk, Cognizant, a caller posing as an employee got an agent to reset the employee’s password, then reset MFA “multiple times without any identity verification at all”. Clorox paused manufacturing, processed orders by hand for weeks, and is suing for $380 million; Cognizant disputes the claims (The Register).

Retool (2023, software).

A text about a payroll problem sent one employee to a fake login page, where they signed in. A caller posing as IT then asked for an MFA code. Retool says the caller “deepfaked our employee’s actual voice” and knew the office layout and coworkers’ names. The employee was suspicious but handed it over, and 27 cloud customer accounts were taken over (Retool).

Silent Ransom Group callback phishing (2023–2025, law firms).

It counts as vishing because the victim is lured into phoning the attacker, and the target is employees with company access, not consumers with money. The FBI says the group emails law firms about a small subscription charge; staff who phone to cancel are sent a remote-access link, and the group copies data for extortion. Since April 2025 it has also phoned staff as IT and sent a person on site to plug in a storage device (FBI).

How to prevent vishing

Personal habits to prevent vishing

Hang up on any call that asks for access or money, and call back on a number from the internal directory, never one the caller gives.
Decline to read out an MFA code or approve a push on an unexpected call, because real IT never asks for either (FBI).
Check an “executive” calling from WhatsApp or an unknown number with a question only the real person could answer, or call back on their known number.

Security controls to prevent vishing

Start remote sessions only through a channel agreed in advance, so a caller cannot talk an employee into one (FBI).
Have the service desk verify identity before any password or MFA reset, require manager approval for MFA changes, and notify the employee and their manager afterwards, so a fake reset is spotted quickly (Mandiant).