Future TechnologyWhat is vishing, and how to prevent the call that got into Abbott
Key takeaways
- Vishing is voice phishing: an attacker phones an employee or a help desk and talks their way past identity verification, with no malware and no exploit involved
- ShinyHunters says a vishing campaign against Abbott and Exact Sciences staff in mid-June captured a Microsoft Entra single sign-on account; Abbott confirms unauthorised access but disputes the claimed scale
- Callback verification on a known number and out-of-band confirmation for any credential reset are the controls that actually break the attack
Two of the loudest breaches of the past few months did not start with an exploit. They started with a phone call.
ShinyHunters says it got into Abbott Laboratories through vishing, a voice phishing campaign aimed at employees in mid-June. The prize was a corporate Microsoft Entra single sign-on account, and from there the group claims it pulled data out of Entra, ServiceNow, SharePoint, Databricks and Coupa. It claims 30 million records in total, including more than 22 million doctor-patient notes. Abbott has confirmed unauthorised access but disputes the scale, and says patient care and manufacturing were not disrupted. Researchers have not independently verified the figures.
The disputed number is not really the point. The entry method is.
What is vishing, and why help desks are the soft spot
Vishing is social engineering over the phone. No malware, no zero-day, no clever payload. Someone calls, sounds plausible, applies a little pressure, and gets a credential reset or an MFA enrolment pushed through.
Help desks are the target because their entire job is to unblock people quickly. The agent on the other end is measured on resolution time and satisfaction scores, and is being asked to say no to someone who sounds stressed, senior and locked out. That is a structural problem, not a training problem.
Voice cloning removed the last informal check. "It sounded like him" was never a strong control, and it is now worth nothing at all.
Why one call turned into five systems
Single sign-on is why the blast radius was so wide. One identity provider vouches for everything downstream, so the credential a phone call captured was not a key to one app; it was a key to the directory that every other app trusts.
That is the same pattern behind the surge in ransomware against large companies this year. Attackers are not out-engineering anyone. They are logging in.
How to prevent vishing calls from working
Three controls do most of the work:
- Callback verification. The help desk never verifies on the inbound call. It hangs up and rings the number already on file.
- Out-of-band confirmation for resets. Any password or MFA change needs a second channel, ideally an approval from someone the caller cannot pressure.
- Remove urgency as a lever. If an agent can be talked out of process by someone sounding senior and impatient, the process is the vulnerability.
For individuals, phishing-resistant hardware helps because it cannot be talked out of you over the phone. A YubiKey 5 NFC binds a login to a physical device and the correct domain, so a convincing voice on a call has nothing useful to ask for.
What to watch next
Expect help desk identity verification to become an audit item rather than an internal policy. It is worth reading alongside this month's 421-CVE Patch Tuesday: patching still matters, but the attacks getting the biggest results this year are not going through the software at all. Everyone has been trained to distrust a dodgy email. Almost nobody has been trained to distrust a familiar voice.
Disclosure: some links in this article are Amazon affiliate links. If you buy through one, we may earn a small commission at no extra cost to you.