When a call comes in from someone claiming to be your IT help desk, urging you to update your passkey or risk losing access to your Microsoft 365 account, most employees comply. That instinct is precisely the entry point that threat actors are targeting. In advisory AL26-010, published this year, the Canadian Centre for Cyber […]
Vishing Awareness: When SaaS Becomes the Attack Surface Read More »
Most ransomware awareness training programs teach employees to recognise malicious attachments, suspicious links, and spoofed sender addresses. That coverage is necessary but no longer sufficient. The ShinyHunters campaign targeting healthcare organisations, reported by HealthSystemCIO on September 10, 2026, reveals the gap: ransomware actors now routinely begin their attack with a phone call, not an email,
What Ransomware Awareness Training Misses About Vishing Read More »
Voice phishing has quietly overtaken email as the preferred entry point for attackers targeting organisations, and no amount of technical filtering closes that gap without genuine behaviour change. According to Google Cloud’s Mandiant M-Trends 2026 report, vishing accounted for 11 per cent of all confirmed initial access methods observed across more than 500,000 hours of
Behaviour Change Cybersecurity: Beating Voice Phishing Read More »
On August 22, 2026, an employee at ReliaQuest, a cybersecurity firm, received a phone call from someone claiming to be a named member of the company’s own security team. The caller directed the employee to authenticate through what appeared to be the company’s single sign-on portal. The employee did. The site was a fake, the
Social Engineering Defence in the Age of Vishing Read More »
Your employees can spot a suspicious email. Fewer of them are prepared for the phone call that follows: someone claiming to be from IT, asking them to register a new passkey, and in minutes the attacker has their Microsoft 365 credentials. This is the active O-UNC-066 campaign, and it targets sectors that form the backbone
Pink Vishing: Security Awareness for Canadian Organizations Read More »
When an employee picks up the phone and hears what sounds like internal IT asking them to re-enrol a multifactor token, the firewall is already irrelevant. That is the quiet truth behind the latest wave of voice phishing attacks that Google’s Mandiant team documented in January 2026, and it is why every Canadian organisation relying
Why Behaviour Change Cybersecurity Beats SSO Vishing Read More »
Picture this: your company’s CFO calls your finance manager to approve an urgent wire transfer before end of day. The voice is familiar, the cadence right, even the slight impatience is typical of how she sounds under deadline pressure. The call is also completely fake. AI voice cloning phishing attacks have matured to the point
AI Voice Cloning Phishing: What Security Training Misses Read More »
When an identity protection company falls victim to a targeted phone scam, the lesson lands harder. On March 19, 2026, Aura confirmed that a vishing attack on one of its employees had exposed nearly 900,000 contact records. For security awareness training professionals and the teams they protect, the incident is not just another breach headline.
Vishing Attack on One Employee Exposed 900,000 Records Read More »
AI voice scam employee training is no longer a future concern for Canadian organizations. On March 9, 2026, Canada’s Competition Bureau issued a public alert warning that scammers are using artificial intelligence to impersonate government officials, politicians, and other trusted figures with a level of realism that makes these calls remarkably difficult to detect. The
When the Boss Calls: AI Voice Scams Target Employees Read More »
