Canadian help-desk vishing campaign bypasses MFA in real time
Original title: AL26-028 – Ongoing Help Desk Voice Phishing Campaign Targeting Canadian Organizations
Callers send staff to branded relay pages, then register MFA methods and steal Microsoft 365 data before extortion.
The Canadian Centre for Cyber Security warned on October 28, 2026, of an ongoing voice-phishing campaign against Canadian organizations, including legal and financial firms. Callers impersonate internal IT support and direct employees to organization-branded adversary-in-the-middle sign-in pages that relay credentials and MFA responses. After access, actors register their own MFA methods, delete security notifications, use Microsoft Graph to take Microsoft 365, SharePoint, and OneDrive data, and send extortion demands. The centre says the tradecraft matches a publicly reported financially motivated actor and that October activity concentrated on the legal sector.
Unconfirmed: The alert says tradecraft is consistent with publicly reported operations but does not name the actor in the visible text.
- Lures claim an urgent passkey migration, MFA enrolment, or password change.
- Calls may reach mobile phones, office phones, or Microsoft Teams and may spoof help-desk numbers.
- Domains often pair words such as enroll or register with passkey, sso, mfa, or 2fa.
- Related infrastructure naming Canadian organizations has been seen since January.
- Recommended controls include FIDO2 or device-bound passkeys and managed-device conditional access.
Impact: Stolen authenticated sessions and Microsoft 365 data, followed by extortion
- 1.Deploy phishing-resistant MFA such as FIDO2 keys or device-bound passkeys for high-risk users.
- 2.Make employees independently verify unexpected IT calls about MFA, passkeys, or passwords.
- 3.If compromise is suspected, revoke sessions, reset credentials, and remove unauthorized MFA methods.
- Vendors
- Microsoft
- Organizations
- Canadian Centre for Cyber Security
- Countries
- Canada
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | internal.com | ly registered domain (e.g., <org-name>sso[.]com , <org-name>internal[.]com ). Domains commonly combine action words such as "activat |
| domain | onetimesso.com | appear as a subdomain of a generic domain (e.g., <org-name>.onetimesso[.]com , <org-name>.registermymfa[.]com ) or be incorporated dir |
| domain | registermymfa.com | eric domain (e.g., <org-name>.onetimesso[.]com , <org-name>.registermymfa[.]com ) or be incorporated directly into a newly registered dom |
| domain | sso.com | ed directly into a newly registered domain (e.g., <org-name>sso[.]com , <org-name>internal[.]com ). Domains commonly combine ac |
From the original article
3 min read at cyber.gc.ca
Serial number: AV26-028 Date: October 28, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.