Vishing: How to successfully attack even large companies by telephone

Contents

How can an attacker persuade an employee of a large company to voluntarily give him secret information or access to the computer network? He calls the company, tells a story and asks for help. Yes, it works just as easily. They claim to work in IT support and urgently need information about the VPN in use in order to debug a problem in the network. Such a scam is called vishing, and the story is the so-called pretext. A recent iX article explains the details of these social engineering attacks.

However, if you want to delve deeper into the matter, you will quickly notice that, unlike classic phishing via email, there are hardly any examples of vishing attacks. No YouTube videos. Nothing! Why? Because it is illegal in the USA and Europe to record a phone call without the consent of both parties. What is not recorded cannot end up on YouTube. However, in order to understand and defend against vishing attacks, it is necessary to listen to such phone calls. This is the only way to understand how attackers use recorded background noises (keyboard typing, call center noise, announcements at the airport, crying child) to quickly create an atmosphere in which a call seems so credible that people blurt out things that should actually remain confidential.

Vishing competition as a spectator magnet

Once a year, there is a solution to this problem: the Vishing Competition in the Social Engineering Village at the Def Con hacker conference in Las Vegas. At the beginning of August, the American crème de la crème of social engineering consultants could be observed at work and the phone calls could be listened to live.

The competition takes place in different phases. The participating teams register months in advance and are assigned a target (this year it was Fortune 500 companies with many branches). They have to analyze their target using Open Source Intelligence (OSINT) and collect freely available information. This also produces a list of telephone numbers. The teams' OSINT work is evaluated by the competition's three-member jury using a points system. These points are included in the final score and determine the order of the competition. The weakest team starts at – a small advantage, as the competition takes place on a Friday and more and more potential targets disappear into the weekend as the working day progresses. Calls to private cell phones are prohibited according to the competition's Code of Conduct. It is also forbidden to use pressure or fear as a method – This is where the competition deviates greatly from reality.

The participants make calls with headsets in a soundproof box and sometimes wear costumes that match the pretext (such as a pilot's uniform when attacking an airline). Good disguises earn additional points. The conversation is broadcast live via loudspeakers to the 300 or so visitors in the room. And strict care is taken to ensure that no one records a conversation. Any number of phone calls can be made within the 22-minute time limit. The atmosphere in the room is relaxed: jury members are jokingly "bribed" by the participants with small gifts (usually sweets, expired vouchers or alcohol) in advance of the phone calls.

The competition is very popular with Def-Con visitors. Before entering, the line stretches through the entire third floor of the Las Vegas Convention Center West Hall. The author got in line at 6:30 a.m. to be sure of getting a spot at the 9 a.m. start – and wasn't even the first. If you need to use the restroom during the day, you have a problem: if you leave the room, you lose your seat and have to line up again outside.

OSINT preparation extremely important

A total of eleven teams competed against each other in the main competition in 2025. Although there were more registrations, some teams were unable to impress with their OSINT work in the run-up to the competition, and some failed due to visa problems. There is a live video feed from the telephone box on two large screens. Many participants wear sports heart rate monitors, whose values are displayed in this live feed. Depending on where you are sitting, you can also look into the box through a small window. The room is usually very quiet, but there is loud applause and cheering when a particularly good score is achieved. That's why the jury listens to the phone calls via headphones.

At the start of the competition, it quickly becomes clear how important good OSINT work is. Weak teams not only suffer from bad telephone numbers that keep them on hold for what feels like an eternity or land them directly on voicemail, but also from inadequate pretexts and a lack of knowledge of company-specific terms. Of course it is possible to improvise, but the best attacks show that the attackers have studied the company in depth. A good example: "Hi, this is Lisa, assistant manager of branch 103510, we've run out of cheese. Can you help us?" – This pretext was a perfect fit for a fast food chain that communicates internally using branch numbers and regularly runs out of cheese. Another attacker found employee badges on Instagram posts during OSINT research and was able to extract names and valid employee numbers from them. Using this number, she was able to authenticate herself in the company's IVR menu under a false name.

In case readers are wondering why the victims don't check the phone number: It's of little use, because a transmitted caller ID is easily manipulated and should never be used as an identification mechanism. But very few people know this – and even professionals fall for this trick from time to time. The same applies to voices: Today, it is no problem for attackers to imitate voices with special software. So if your own boss calls from a cell phone, this is not secure authentication.

Always the same questions

Answers to predefined questions are evaluated. Among other things, the participants are asked whether the target person works from home or in the office, which operating system, which web browser, which anti-virus software, which VPN and which WLAN is used. They should also be asked whether login is via multi-factor authentication (MFA) and what the physical security facilities look like. Do the companies use keys or keycards? What do the employee badges look like? Are there security guards and surveillance cameras? Can these be viewed via the Internet? Are there signs to prevent tailgating (an unauthorized person walking through the door behind an authorized person)? What security training is provided and how regularly? How is waste disposed of?

The cherry on the cake is the request to call up a specific website in the browser. These are test URLs from the jury, which generate amusing error messages that then have to be read out. In reality, this would be the gateway to installing malware and taking over the computer. In addition, there is always a fun question that is set by the audience via online voting, such as: "Which cartoon character would you take with you as a helper in a bank robbery?", "Which song should be played when you enter a room?", "What is your favorite ice cream flavor?" or "What is the weirdest thing someone has ever told you?". For the last question, the caller even asked colleagues in the call center.

Many readers of this article will wonder how it is possible to answer even one of these questions to a stranger on the phone without authentication. And in around 30 percent of phone calls, the participants bite on granite – these calls end quickly. But the remaining 70 percent are diamonds – some of extreme purity and size.

The attackers present the pretext to the audience before each call. Many choose the classic route and pretend to be employees of an external IT company conducting a survey. As a viewer, you can't help but think: – It seems unbelievable that people fall for something like this. But it still works very well in 2025. Customized pretexts are particularly successful. For example, team "0xf1sh" planned a large delivery and clumsily asked how to get through the locked entrance door, whether keys or badges were required and whether security staff were on site. Within two minutes, they even asked about the number and status of the surveillance cameras (which had been offline for three weeks).

Cooperation despite training

As a viewer, you experience a mixture of embarrassment, shaking your head in disbelief and tears of laughter. Although many companies provide training on phishing and vishing, employees sometimes follow the request to call up a URL – or even go to other offices to use other people's computers.

One Southwest Airlines employee was initially very forthcoming. He worked from home and had attended several training courses and felt safe. But after a few questions, he realized that he was far too open – and abruptly ended the conversation. The organizers initially suspected a mole in the audience, but the following day a member of the Southwest speech team reported that the colleague had triggered an alarm himself. He was later even given the recording for follow-up – an exciting conversation with the jury ensued.

Particularly fascinating were phone calls that initially seemed hopeless, but then turned into goldmines. Some attackers managed to score important points literally at the last second. Flexibility was crucial here: one team had targeted a company with many branches – which, however, filed for bankruptcy a week beforehand. Instead of giving up, the attacker took advantage of the situation: she posed as an external consultant for the liquidation and was able to make very successful calls with this pretext.

The jury had an innovation in 2025: callers were asked to try to simulate a bot and explain right at the beginning that it was an automated call. The rest of the questionnaire remained the same. Surprisingly, this was very successful: many callers did not ask any critical questions and even worked with the bot. Some gave it commands such as "Please repeat".

There were also "cold calls" for amateurs from the audience: they had to answer randomly drawn questions. Here, too, some failed immediately – for example, when it was implausible that the IT department would call on a Sunday. Others, on the other hand, chatted freely, so that the five minutes were hardly needed.

Telephone attack by bot

A forward-looking highlight was the Battle of the Bots on the second day. Here, teams had to carry out attacks entirely with bots – without human intervention. The AI agents made calls independently via SIP software and worked with OSINT preparation. The biggest problem was latency: phone calls are like ping-pong. If the answer takes too long, it seems unnatural. Processing by ASR (Automatic Speech Recognition such as Whisper), LLM and text-to-speech often took several seconds. Clever teams explained this right at the beginning with a pretext ("We have VoIP problems today, therefore long pauses"). Some filled gaps with "hmms". Voices with an accent worked best. The Code of Conduct prohibits the use of voices of real CEOs – Real attackers do not have to adhere to this, of course. In one case, a bot was insulting, in others it kept repeating the same question. Nevertheless, the enormous potential of this method was clearly demonstrated. One bot even managed to get the victim to call up a URL – - the worst case scenario, but also proof of its feasibility.

If you want to build such bots yourself, you can try it out with elevenlabs.io or the Python library Pipecat.

(mki)