Google and data: hackers used phone calls, phishing websites, and "meticulous" tactics to target dozens of US PE firms and other businesses over the past month (Reuters)

Over the past month, threat actors added telephone outreach to their usual phishing-website approach, using careful planning to approach dozens of US private-equity firms and other businesses. This shift means that malicious messages can arrive via voice rather than only through email, potentially bypassing existing mail-gateway filters. The use of both channels together suggests a multi-step social-engineering process designed to increase trust before delivering a malicious link.

Defending against this pattern may require additional controls such as call-screening tools, user training that treats unsolicited calls as suspicious, and logging of web-requests that follow a phone conversation. Implementing these measures can raise operational costs, demand updates to incident-response playbooks, and increase the workload for security-operations teams. Engineers must weigh the benefit of detecting voice-initiated credential theft against the overhead of new monitoring and training programs.

If organizations rely solely on email-based defenses, the phone-call component can remain unseen, allowing attackers to succeed. Conversely, if attackers adapt by moving to other communication methods or by refining their social-engineering scripts, the current mitigations may lose effectiveness. Thus, the protection offered by added call-aware controls is contingent on maintaining visibility across both voice and web vectors and on keeping user awareness up to date.