Vishing Attacks Exploit Human Trust to Hijack SaaS Credentials and MFA
Written by AI from the linked story. Not reviewed by an editor. How this works
UNC6671 demonstrates how sophisticated social engineering via phone calls can bypass technical controls entirely by targeting the human element. By impersonating IT staff and directing employees to adversary-in-the-middle phishing portals, attackers capture both passwords and real-time MFA tokens before the victim realizes anything is wrong. This matters because once SaaS platforms like Microsoft 365 and Okta are compromised, attackers gain broad access to sensitive organizational data with legitimate credentials, making detection extremely difficult. The attack highlights that MFA alone is insufficient when users can be manipulated into surrendering tokens in real time.
Tactical Insight
Immediate actions
- Train all employees to never provide credentials or MFA codes over the phone, even to callers claiming to be internal IT staff.
- Implement phishing-resistant MFA methods (e.g., FIDO2/passkeys) that cannot be replayed by adversary-in-the-middle infrastructure.
- Establish a verified IT callback procedure so employees can confirm the identity of any caller requesting sensitive actions.
Long-term improvements
- Deploy Conditional Access Policies in SaaS platforms to restrict logins from unexpected geolocations, devices, or network ranges.
- Enforce a Zero Trust architecture requiring continuous verification of identity and device posture before granting SaaS access.
- Conduct regular vishing simulation exercises targeting high-risk departments such as finance and HR.
Detection measures
- Enable SIEM alerting on anomalous SaaS login events, including impossible travel, new device registrations, and bulk data downloads.
- Monitor Okta and Microsoft 365 audit logs for large-scale data exports or OAuth token grants to unfamiliar applications.
- Integrate threat intelligence feeds for known AiTM infrastructure indicators to block malicious proxy domains at the perimeter.