--- title: What is vishing? How voice phishing attacks work and how to defend against them description: Vishing scams use voice calls and AI deepfakes to steal credentials and bypass MFA. See how it fuels ransomware and how Acronis defends against it. canonical_url: https://www.acronis.com/en/tru/threat-catalog/social-engineering/vishing/ locale: en last_updated: 2026-10-11 --- # What is vishing? How voice phishing attacks work and how to defend against them Vishing scams use voice calls and AI deepfakes to steal credentials and bypass MFA. See how it fuels ransomware and how Acronis defends against it. [Download Threat Report](https://www.acronis.com/en/resource-center/resource/acronis-cyberthreats-report-h2-2025/) [See How Acronis Stops Threats](https://www.acronis.com/en/products/cloud/demo/) ## Key takeaways 1. Vishing (voice phishing) is a voice-based [social-engineering](https://www.acronis.com/en/tru/threat-catalog/social-engineering/) technique used to steal credentials, bypass MFA and induce installation of remote-access tools. 2. [Mandiant M-Trends 2026](https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026) ranks voice phishing as the second most common initial infection vector in 2025, present in 11% of investigations where a vector could be identified; [Verizon's 2025 DBIR](https://www.verizon.com/business/resources/reports/dbir/) attributes 19% of breaches to smishing or vishing combined. 3. The human element was present in approximately 60% of breaches (Verizon, 2025 DBIR). 4. Stolen credentials, often obtained through vishing and other forms of social engineering, underpin approximately 22% of breaches and 30% of intrusions, enabling silent access, ransomware deployment and credential resale through initial access brokers. 5. Acronis mitigates vishing-driven intrusions through [identity monitoring](https://www.acronis.com/en/products/cloud/cyber-protect/extended-detection-and-response/), [EDR](https://www.acronis.com/en/products/cloud/cyber-protect/security-edr/) / [XDR](https://www.acronis.com/en/products/cloud/cyber-protect/extended-detection-and-response/) correlation, [Active Protection](https://www.acronis.com/en/products/cloud/cyber-protect/features/) against encryption and rapid, [malware-free recovery](https://www.acronis.com/en/products/cloud/cyber-protect/backup/), though recovery does not undo data already exfiltrated before detection. ## What is vishing? Definition and types Vishing is the use of voice communications to deceive victims into divulging credentials or performing actions that compromise security. Vishing often occurs as part of telephone-oriented attack delivery (TOAD) campaigns that blend email or SMS lures with a callback number. Consumer vishing focuses on small-scale financial fraud. Victims are asked to disclose credit card numbers, bank passwords or one-time codes. Enterprise vishing targets employees, contractors and suppliers. Attackers use open-source intelligence to impersonate executives or IT staff and harvest session tokens or persuade users to disable MFA. TOAD attacks combine phishing emails or SMS messages with a voice call back. The victim believes they are contacting legitimate support and is persuaded to install remote access software or visit fraudulent pages. By reframing vishing as an intrusion vector rather than a simple "scam," defenders can align controls with credential compromise, initial access and downstream ransomware deployment. ## How does a vishing attack work? The vishing attack lifecycle Modern vishing follows a structured lifecycle, each phase with specific attacker objectives and business impacts. 1. Reconnaissance: Adversaries harvest open-source intelligence from LinkedIn, GitHub and corporate websites to build believable personas and gather support numbers. This preparation produces convincing pretexts that lower victim suspicion and increase successful credential harvesting. 2. TOAD callback lure: Attackers send phishing emails or smishing messages instructing the recipient to call a spoofed "support" number. This bridges email / SMS and voice channels, bypassing technical filters and placing the victim in a high-trust interaction under artificial urgency. 3. AI voice cloning: During the call, attackers employ real-time voice modulation and deepfake technology to impersonate executives or IT staff. Victims reveal MFA codes, disable security controls or install remote access tools because the caller sounds genuine; this exploits trust in a familiar voice, not an authentication mechanism, since voice recognition was never a verified identity control to begin with. 4. Exploitation: Attackers gain access via credential abuse or legitimate remote-management tools such as ScreenConnect or AnyDesk, harvesting session tokens and credentials while evading detection. Access is also sold on dark-web forums via initial access broker markets. 5. Ransomware or BEC monetization: Stolen credentials are used directly to deploy ransomware or execute BEC fraud or sold to downstream actors. Valid logins allow attackers to dwell undetected for weeks before encrypting data or redirecting payments. ## Vishing by the numbers: Key statistics (2024 to 2026) **Metric** **Value** **Source** Voice phishing as an initial infection vector (2025) Second most common vector; present in 11% of investigations Mandiant M-Trends 2026 (Google Cloud) Breaches originating from smishing or vishing combined 19% Verizon 2025 DBIR Deepfake vishing surge (Q1 2025 vs Q4 2024) 680% growth [Right-Hand AI, 2025 report](https://right-hand.ai/blog/deep-fake-vishing-attacks-2025/) (single-vendor finding) Median financial loss per victim $1,400 Right-Hand AI, 2025 report (single-vendor finding) Human element present in breaches 60% Verizon 2025 DBIR Median ransom payment (2024) $115,000 Verizon 2025 DBIR Businesses that shared sensitive info during a vishing call (2025) 70% [Keepnet Labs study, 2025](https://keepnetlabs.com/) ## Why does vishing lead to ransomware? Vishing is a seamless on-ramp to ransomware and BEC because it delivers valid credentials without triggering technical defenses and can be used to bypass two-factor authentication. According to Verizon, stolen credentials are involved in 22% of breaches, and initial access brokers harvest them via vishing to resell to ransomware operators. A five-minute vishing call can provide the credentials that allow hackers to dwell silently for weeks before deploying ransomware. Once inside, attackers can establish persistence, elevate privileges and attempt to move laterally to expand their access. External pressure to pay is high, but with integrated detection and rapid recovery, businesses can restore quickly and reduce the attacker's leverage. For more context on ransomware, see the [Acronis ransomware catalog](https://www.acronis.com/en/tru/threat-catalog/malware/ransomware/). To understand other social-engineering vectors, consult the Acronis social engineering catalog. ## Which threat actors use vishing? The following threat actors and clusters have documented ties to voice-phishing tactics, sourced to government advisories and Mandiant's primary threat research. Where a specific incident (a dollar figure, a named victim) circulated in secondary reporting but is not confirmed in a primary source, that detail is omitted below rather than repeated as fact; only the sourced attribution and general modus operandi are presented. For more profiles, visit the [Acronis threat-actor catalog](https://www.acronis.com/en/tru/threat-catalog/attack-groups/). **Threat actor / cluster** **Region / characterization** **Vishing method** **Primary-source attribution** UNC6040 / The Com Cybercrime collective umbrella, including UNC3944 (Scattered Spider) and UNC6040 Voice phishing for help-desk impersonation and SaaS-credential theft; observed convincing targets to authorize attacker-controlled SaaS applications, leading to ShinyHunters-branded extortion. Mandiant M-Trends 2026 (Google Cloud) Scattered Spider / Muddled Libra Targets telecom and financial services Persuades help desks to reset MFA and bypass credentials. [CISA/FBI joint advisory AA23-319A](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a) Black Basta / Cactus Russian-speaking ransomware operators Blends vishing with phishing, including Microsoft Teams-based voice contact and email-bombing followed by a call, to accelerate privilege escalation. [CISA Advisory AA24-131A](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-131a), “#StopRansomware: Black Basta” Lazarus Group State-sponsored (North Korea) Uses social-engineering impersonation of recruiters and trusted contacts, with deepfake voice tactics reported in broader industry coverage, for strategic data theft. [CISA/FBI/Treasury advisory AA22-108A](https://www.cisa.gov/sites/default/files/publications/AA22-108A-TraderTraitor-North_Korea_APT_Targets_Blockchain_Companies.pdf), “TraderTraitor” ## How does Acronis protect against vishing? Acronis mitigates vishing across identity, endpoint and recovery layers. The table below maps each stage of the vishing attack lifecycle to the risk, the capability required to address it and the corresponding Acronis response. **Attack stage** **Risk** **Required capability** **Acronis capability** **Outcome** TOAD lure Email or SMS callback lures prompt victims to call an attacker-controlled number. Advanced email filtering that recognizes spoofed domains and linguistic patterns [Acronis Email Security](https://www.acronis.com/en/products/cloud/cyber-protect/email-security/) Uses AI-driven linguistic analysis and [URL filtering](https://www.acronis.com/en/products/cloud/cyber-protect/email-security/) to block callback lures before they reach inboxes. Post-vishing activity The victim installs infostealers or remote-access tools, or shares session tokens after the voice call. Endpoint and identity visibility to detect malware or legitimate tools used maliciously Acronis EDR/XDR Detects malicious activity and correlates identity signals, such as unusual IP addresses or new RMM processes, to identify and isolate compromised endpoints. Ransomware attempt Attackers use the access gained through vishing to spread across the network and begin file encryption. Behavioral malware detection and automatic rollback Active Protection (behavioral engine) Uses heuristics and machine learning to identify unauthorized file encryption in real time and automatically restore affected files. Data exfiltration Attackers use vishing-obtained access to exfiltrate data for extortion before any encryption occurs. Prevention of the exfiltration itself, not just recovery afterward Not currently addressed by Acronis backup and recovery capabilities Acronis has no capability that prevents or reverses data exfiltration once it has occurred. [Immutable backup](https://www.acronis.com/en/products/cloud/cyber-protect/cloud-storage/) and malware-free restore protect data integrity and availability; they do not stop data theft or remove an attacker's leverage in a double-extortion scenario. This gap should be disclosed rather than implied away. Post-intrusion recovery Attackers corrupt or delete backups, or normal operations are disrupted after the intrusion. Malware-free recovery and forensic investigation [Safe Recovery](https://www.acronis.com/en/products/cloud/cyber-protect/backup/), [Forensic Mode](https://www.acronis.com/en/products/cloud/cyber-protect/) and [backup anti-malware scanning](https://www.acronis.com/en/products/cloud/cyber-protect/backup/) Safe Recovery scans backups with the latest definitions to prevent reinfection; Forensic Mode collects memory dumps and process logs for investigation; backup anti-malware scanning ensures infostealers delivered during the intrusion are not restored alongside clean data. ## Frequently asked questions about vishing ### What is the difference between vishing, smishing and phishing? Vishing is a type of social-engineering attack delivered by voice calls or voicemail, while phishing typically uses email and smishing uses SMS or text messages. All three aim to trick victims into revealing sensitive information or taking an action, but they differ primarily in the communication channel and interaction style. ### What are common examples of vishing scams? Common vishing scams include bank impersonation, where scammers claim there is an issue with the victim's account and ask for login details; government impersonation, where callers pretend to represent an agency and request personal data; technical support scams, where fraudulent callers prompt victims to grant remote access or share credentials; and prize or offer scams, where notices of winnings require payment or information to claim. Always be skeptical of unsolicited callers asking for sensitive information. ### How does caller ID spoofing work in vishing attacks? Attackers often use caller ID spoofing to make a vishing call appear as if it's coming from a trusted or local number. This is frequently done using Voice over IP (VoIP) technology so that the displayed number is misleading, increasing the likelihood that the victim answers and trusts the caller. ### Can vishing occur via VoIP or internet calls? Yes. Modern vishing often leverages VoIP and internet calling systems because these technologies allow attackers to cheaply place calls and easily spoof caller IDs, making the vishing call seem legitimate. ### What are key warning signs of a vishing call? Watch for unsolicited calls requesting urgent action, pressure to share sensitive information immediately, caller ID that looks familiar but may be spoofed, and requests for passwords, bank details or verification codes. If in doubt, hang up and verify the caller through an official channel. ### How does AI and deepfake voice technology affect vishing? AI voice cloning enables vishing attackers to generate highly realistic fake voices that can impersonate known individuals or executives. These deepfake audio vishing calls make attacks more convincing and harder to detect because the voice sounds authentic. ### Is vishing a threat to both individuals and businesses? Yes. Vishing targets individuals for identity theft and financial scams, and businesses for credential theft and fraud. In business settings, vishing attackers may impersonate executives or IT staff to gain credentials, making the threat significant across sectors. ### What should I do if I think I've been targeted by a vishing scam? If you suspect a vishing attempt, hang up immediately, verify the organization's contact information independently and report the incident to your IT or security team or the relevant authority. Never call back using a number provided by the suspicious caller. ### Can caller ID apps help block vishing calls? Caller ID and spam-detection apps can flag suspicious numbers and reduce the likelihood of answering known spam sources. They do not eliminate vishing risk completely but can provide an additional layer of awareness before answering. ### What regulatory or safety guidance exists to prevent vishing? Many regions offer resources and reporting channels for phone fraud. In the United States, for example, registering a number on the Do Not Call list can reduce unsolicited calls, and vishing incidents can be reported to agencies like the FTC or local cybercrime units. Always follow guidance from official fraud-prevention organizations to improve call safety. Related attacks & insights 18 February 2026 ![Image 1: Acronis Cyberthreats Update, February 2026](https://staticfiles.acronis.com/images/content/30f8aab3493241e5754eece2e886ad33.png) [Acronis Cyberthreats Update, February 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-february-2026/) The Acronis Cyberthreats Update covers current cyberthreat activity and trends, as observed by Acronis... Author:[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/) 04 November 2025 ![Image 2: The DragonForce Cartel: Scattered Spider at the gate](https://staticfiles.acronis.com/images/content/60a4e519d7517b633027b84c17281169.png) [The DragonForce Cartel: Scattered Spider at the gate](https://www.acronis.com/en/tru/posts/the-dragonforce-cartel-scattered-spider-at-the-gate/) Acronis Threat Research Unit (TRU) analyzed DragonForce, a Conti-derived ransomware-as-a-service... Author:[Darrel Virtusio](https://www.acronis.com/en/tru/authors/virtusio-darrel/) 18 August 2025 ![Image 3: MSP cybersecurity news digest, August 4, 2025](https://staticfiles.acronis.com/images/content/59c8ee5899e3facb0704959e3693eab5.png) [MSP cybersecurity news digest, August 4, 2025](https://www.acronis.com/en/tru/posts/msp-cybersecurity-news-digest-august-4-2025/) Scattered Spider group disrupted, but imitators carry on, Fake OAuth apps and Tycoon phishing kit used... Author:[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/) Related attacks & insights [What is phishing? How phishing attacks work and how to defend against them](https://www.acronis.com/en/tru/threat-catalog/social-engineering/phishing/) [What is Akira ransomware and how does Akira ransomware attack your organization?](https://www.acronis.com/en/tru/threat-catalog/malware/ransomware/akira/) [What is StealC malware? How StealC works, its role in ransomware and how to defend against it](https://www.acronis.com/en/tru/threat-catalog/malware/infostealers/stealc/) [What is Lumma Stealer (LummaC2), how LummaC2 malware works and how to defend against it](https://www.acronis.com/en/tru/threat-catalog/malware/infostealers/lumma/)