Fake IT help desk calls target Canadian legal and financial firms

The Canadian Centre for Cyber Security warned on Oct 28 of an ongoing voice phishing campaign against Canadian organizations, with October’s activity concentrated on the legal sector. Callers posing as internal IT staff claim an urgent passkey migration, MFA enrollment or password change is needed, and send employees to sign-in pages branded with the organization’s name. The pages relay credentials and MFA responses to the real identity provider, which hands the attacker a signed-in session.

The pages sit on organization-branded subdomains of generic domains, like <org-name>.onetimesso[.]com and <org-name>.registermymfa[.]com, or on new domains such as <org-name>sso[.]com. Their names mix words like activate, enroll and register with passkey, sso, mfa or 2fa. The domains change often, which limits blocklists. Calls may come to mobile phones, office phones or Microsoft Teams, and may spoof the real help desk number.

Once signed in, the attacker registers its own MFA methods or devices and deletes password-reset and security notification emails. It then uses scripts and Microsoft Graph to take data from Microsoft 365 and connected apps, including SharePoint and OneDrive. An extortion demand follows. The Cyber Centre has seen related infrastructure naming Canadian organizations since January.

The Cyber Centre says the tradecraft and infrastructure are consistent with public reports on a financially motivated group. It cites Google Threat Intelligence posts on UNC6671 and on a vishing extortion operation called BlackFile. It doesn’t name the group behind the Canadian calls.