Google’s AI Overviews will show you advice from other people now
Google is updating AI Overviews with five new features, including an improved way to preview and explore sources.
Latest news – Read More
How VoidStealer bypasses Chrome’s protections to hijack sessions and steal data | Kaspersky official blog
Malicious actors have developed a new way to steal data stored by Chrome for Windows. Researchers discovered the technique while analyzing a fresh build of an infostealer known as VoidStealer. The new method allows the malware to bypass Chrome’s Application-Bound (App-Bound) Encryption (ABE), a mechanism intended to protect session cookies and other valuable information stored in the browser.
Google hoped this mechanism would secure the master key Chrome uses to encrypt all sensitive data. Unfortunately, this isn’t the first time malware authors have found a workaround for this defense — leaving secrets stored in Chrome vulnerable once again.
How App-Bound Encryption works in Chrome
Google introduced App-Bound Encryption in July 2024 with the release of Chrome version 127. The company’s announcement mentioned infostealers snatching cookies from Chrome users on Windows as the primary problem ABE was intended to solve. We’ve already covered in detail what these files are and the consequences of their theft, so we’ll only briefly recap the main facts here.
Cookies are small files that the browser saves to the user’s device at a website’s request to remember various site settings. Of particular value to attackers are session cookies, which are used for automatic authentication on websites. It’s thanks to these files that we don’t have to enter a username and password every time we revisit a site.
But this convenience carries a risk: stealing these files allows an attacker to use an already-authenticated session without entering a username or password. This allows them to impersonate the user, which can lead to account hijacking, theft of personal or financial data, and other adverse consequences.
Infostealer Trojans are particularly dangerous for Chrome users on Windows. This is because, on this OS, Chrome previously relied solely on the standard built-in Data Protection API (DPAPI). With this system encryption mechanism, applications don’t need to create and store encryption keys to protect data.
The limitation of DPAPI is that it doesn’t protect data from malware that’s already successfully compromised the system and is capable of executing code on behalf of the logged-in user. This is exactly what stealers exploit: since they typically run with the user’s privileges, they can simply request DPAPI to decrypt the browser’s protected data.
The ABE mechanism was designed to solve that specific problem. The core idea is right in the name: App-Bound Encryption means the encryption is tied to a specific application. To achieve this, a separate service running with system privileges is responsible for protecting the key used to encrypt Chrome’s data. It verifies which application is requesting access to the key, and denies the request if it doesn’t originate from Chrome.
Chrome’s App-Bound Encryption (ABE) was designed so that only Chrome itself could retrieve the master key needed to decrypt the browser’s stored data. Source
As a result, the architects of this feature assumed that to access ABE-protected browser data, an infostealer would either need to escalate its privileges to system-level, or inject malicious code directly into Chrome. In theory, this should have made attacking Chrome significantly harder and reduced the effectiveness of mass-market infostealers. As you might have guessed, things didn’t go quite that smoothly in practice.
Previous successful bypasses of Chrome’s ABE
Just a couple of months after Google announced the implementation of App-Bound Encryption in Chrome, many infostealer developers claimed they’d already bypassed the protection. Among them were the creators of Meduza Stealer, Whitesnake, Lumma Stealer, and Lumar (also known as PovertyStealer).
Lumma stealer developers announce a bypass for Chrome’s App-Bound Encryption in a new version of the malware
Of course, you shouldn’t take malware developers at their word, but legitimate security researchers were able to confirm at least some of the claims. Bypasses for Google Chrome’s new data protection feature did become available almost immediately after its release.
A month later, in October 2024, tech enthusiast Alex Hagenah published a tool on GitHub called Chrome-App-Bound-Encryption-Decryption to bypass Google’s new security mechanism. Analysis of the tool’s code revealed that its author used roughly the same methods that attackers were already heavily exploiting.
What followed was a game of cat and mouse: security researchers and stealer developers came up with new tricks to circumvent App-Bound Encryption, while Google patched the newly discovered loopholes with varying degrees of success.
VoidStealer — a new data-nabbing menace
This brings us to recent events: in March 2026, news broke about a stealer named VoidStealer, which utilizes a brand-new and, by all accounts, highly effective method for bypassing ABE.
VoidStealer developers advertising a new method for bypassing ABE. Source
The malware authors developed an attack technique that targets the brief moment when the master key sits in the browser’s memory in plaintext. This occurs because, at a certain point, the browser inevitably has to decrypt its data to actually use it — for instance, to automatically sign in to a website with the relevant session cookie or to access saved credentials.
To exploit this window of opportunity, the malware attaches itself to the Chrome process as a debugger — a tool that allows one to control a program’s execution, pause it, and inspect its memory. In legitimate scenarios, these tools are used by developers to find and fix bugs, analyze application behavior, and test performance.
The malware identifies the specific section of code where data decryption takes place. It then sets a breakpoint at that location; when the program’s execution reaches that point, the browser effectively freezes. This is how the malware catches the exact moment the master key is sitting in RAM in plaintext; it then reads the key directly from memory.
It’s worth noting that everything mentioned above also applies to other Chromium-based browsers that use ABE, including Microsoft Edge, Brave, Opera, Vivaldi, and others.
How to avoid falling victim to infostealers
The scale of VoidStealer’s reach could be significant, as its developers operate under the malware-as-a-service (MaaS) model. This means they rent out the ready-made tool to other attackers, so they don’t need to develop custom malware from scratch.
This situation demonstrates that relying solely on built-in security mechanisms isn’t enough. Unfortunately, stealer developers are coming up with new workarounds faster than browser and operating system developers can roll out patches.
Here’s what users can do about it:
- Avoid installing programs from suspicious sources. This will minimize the chances of malware infiltrating your system.
- Learn how ClickFix attacks Lately, stealers have frequently been distributed using this specific malicious tactic.
- Keep your OS and software updated on all devices. Timely updates help patch many of the vulnerabilities that malware exploits.
- Install a robust security solution on all your devices. It’ll block suspicious activity in real time and alert you to potential threats.
As an added precaution, avoid storing passwords and bank card info in Google Chrome or your Notes app, as these are the first places any self-respecting stealer looks. Instead, use a secure password manager.
Stealers are hunting for your data, finding ways to infiltrate both computers and smartphones alike. To protect yourself from theft, check out our other related posts:
- Crypto thieves ramping up attacks on Apple users
- CrystalX RAT can flip your screen and steal your crypto
- Android Trojan posing as government services and Starlink apps
- Stealka stealer: the new face of game cheats, mods, and cracks
- Your cat pics are at risk: the threat posed by the new SparkKitty Trojan
Kaspersky official blog – Read More
Get Amazon Prime for 6 months totally free if you’re age 18-24 – here’s how
Amazon’s Prime for Young Adults plan gets college students and other young people a big break on the membership. Here’s what to know.
Latest news – Read More
10 trillion downloads are crushing open-source repositories – here’s what they’re doing about it
Companies are treating these repositories like content delivery networks – now the Linux Foundation and colleagues are saying enough is enough. Here’s the plan.
Latest news – Read More
CISA: Critical Infrastructure Must Master Isolation, Recovery
The agency has issued guidance to help critical infrastructure operators prepare for cyberattacks by foreign threat actors.
The post CISA: Critical Infrastructure Must Master Isolation, Recovery appeared first on SecurityWeek.
SecurityWeek – Read More
Wix vs. Squarespace: I compared two of the top website builders, and this one wins
Wix and Squarespace are two of the most popular website builders – so how do they compare?
Latest news – Read More
How CISOs Reduce Cyber Risk with MITRE ATT&CK
Nowadays CISOs face escalating threats that outpace traditional defenses. The strategy is evolving from compliance-driven checklists to a threat-informed approach. MITRE ATT&CK provides a globally accessible knowledge base of real-world adversary tactics, techniques, and procedures (TTPs), enabling organizations to understand, prioritize, and counter actual attacker behaviors rather than abstract controls.
This shift helps align security efforts with business realities: minimizing downtime, protecting revenue streams, safeguarding customer trust, and potentially lowering cyber insurance premiums through demonstrated proactive risk management.
Executive Summary
- Compliance-driven security measures control maturity, not adversary readiness. Threat-informed defense anchors risk management in real attack behaviors, which is where actual risk lives.
- MITRE ATT&CK provides the taxonomy, not the intelligence. The framework names and structures adversary techniques; organizations need curated, real-world threat data to make those techniques actionable.
- SOC workflow integration is non-negotiable. MITRE ATT&CK delivers risk reduction only when embedded into monitoring rules, triage processes, IR playbooks, and hunt methodologies.
- Speed of context determines security outcomes. Whether in triage or incident response, the time it takes to understand what a threat is doing directly determines how much damage it can cause. ANY.RUN’s Threat Intelligence Lookup and Sandbox compress that context-gathering from hours to seconds.
- Threat hunting requires real attack patterns, not just technique categories. Generic ATT&CK-based hunt queries produce noise; high-fidelity feeds of current attacker behavior produce findings.
- Risk reduction is measurable. MTTD, MTTR, MTTC, hunt yield rate, and false positive ratios are the business-level metrics that translate MITRE ATT&CK investment into language boards and insurers understand.
Two Lenses, One Risk: Compliance vs. Adversary-Centered Approach
Traditional risk management often relies on vulnerability scanning, compliance audits (e.g., NIST, ISO), and static controls. It focuses on known weaknesses and regulatory requirements but frequently misses how attackers chain behaviors in live environments.
MITRE ATT&CK is adversary-centric and behavior-focused. It maps real-world TTPs across tactics like Initial Access, Execution, Persistence, and Impact. This enables gap analysis, threat modeling, and measurable improvements in detection and response.
| Dimension | Traditional Risk Management | MITRE ATT&CK Approach |
|---|---|---|
| Risk Basis | Regulatory requirements & audit findings | Real-world adversary techniques & behaviors |
| Threat Model | Generic, category-level threats | Specific ATT&CK tactics, techniques, sub-techniques |
| Detection Focus | Signature-based, perimeter controls | Behavioral analytics across the kill chain |
| Measurement | Control maturity, audit pass/fail | Detection coverage mapped to ATT&CK matrix |
| Response Approach | Incident → remediation → compliance update | Continuous detection, hunt, iterate |
| Business Language | Risk scores, audit gaps | Mapped MITRE techniques tied to business impact |
| Tooling | GRC platforms, scanners | SIEM + EDR + Sandbox + TI Feeds |
The most important takeaway from this comparison is not that compliance is worthless. It isn’t. Regulatory requirements create accountability, force documentation, and establish minimum hygiene floors that matter for smaller organizations with limited resources. The problem arises when compliance becomes the ceiling rather than the floor.
Where Strategy Meets Reality: Making MITRE ATT&CK Operational
MITRE ATT&CK is not a product. It does not detect threats. It does not alert your analysts, contain attackers, or generate threat intelligence. The organizations that extract real risk reduction from MITRE ATT&CK are those that connect the framework’s taxonomy directly to how their SOC actually operates: the tools analysts use, the data they see, the workflows they follow under pressure.
| SOC Workflow | What MITRE Provides | What SOC Actually Needs | How ANY.RUN Bridges the Gap |
|---|---|---|---|
| Monitoring | Identify techniques to watch | Alerts linked to ATT&CK IDs | TI Feeds: live IOC & technique feeds; Sandbox: real-time detonation signals |
| Triage | Explain technique & impact | Fast analyst context on behavior | TI Lookup: instant technique context + related samples; Sandbox: behavioral report |
| Incident Response | Provide structural framework | Full execution context to contain | Sandbox: full process tree, network, registry; TI Lookup: lateral movement history |
| Threat Hunting | Suggest what to search for | Real attack patterns as hypotheses | TI Feeds: emerging technique clusters; TI Lookup: hunt pivot on IOCs & TTPs |
1. Eyes Wide Open: Enhancing Monitoring for Early Threat Detection
MITRE ATT&CK is a powerful compass for monitoring strategy. It tells defenders which techniques adversaries use during specific phases of an attack. T1566 (Phishing) for initial access, T1055 (Process Injection) for defense evasion, T1021 (Remote Services) for lateral movement, etc. Security teams can use the framework to build detection hypotheses, design SIEM rules, and prioritize which telemetry sources to collect.
What the SOC Actually Needs
The value of monitoring emerges from early visibility to enable swift action, reducing dwell time and limiting blast radius. Analysts need alerts with sufficient fidelity and timeliness to intervene while the attack is still in progress. That requires not just knowing which techniques exist, but understanding the current threat landscape: which groups are active, which malware families are being deployed this week, and which detection signatures are already stale.
Solution: Stay Current with Live Threat Feeds to Cut Detection Lag
Threat Intelligence Feeds provide continuously updated, machine-readable threat intelligence stream of IOCs (indicators of compromise) with malware family tags derived from real detonations in ANY.RUN’s Interactive Sandbox. Security teams can pipe these feeds directly into their SIEM or EDR, ensuring that MITRE-mapped detection rules stay current with actual adversary activity.
Business objective: Cut MTTD for novel threats. Increase the ratio of high-fidelity alerts to total alerts, lowering analyst alert fatigue and improving coverage of emerging attack vectors.
2. Speed Matters: Accelerating Triage with Behavioral Context
MITRE maps alerts to techniques, but analysts need rapid understanding of intent, impact, and validity to avoid alert fatigue. An alert tagged T1059.001 (PowerShell) tells an analyst that the technique involves command and scripting interpreter abuse. T1112 (Modify Registry) points to potential persistence or defense evasion. This context is valuable. But it is the starting point, not the destination.
What the SOC Actually Needs
Analysts dealing with hundreds of alerts per shift cannot afford multi-minute pivot chains to understand whether a flagged PowerShell execution is a legitimate IT automation script or the first stage of a ransomware deployment. They need behavior and impact context fast: What did this process actually do? Has this file hash or domain been seen in confirmed malicious activity?
Solution: Reduce MTTD with Full Attack Visibility inside a Sandbox
Threat Intelligence Lookup is a searchable threat data repository built on ANY.RUN’s analysis history. Analysts can query file hashes, IPs, domains, URLs, and process names and instantly surface related sandbox reports with MITRE ATT&CK mappings, malware family attributions, and associated threat actor context.
During triage, analysts can answer the key questions before escalating: Is this a known threat? What does it do? Which ATT&CK techniques are involved? What is the likely impact?
Interactive Sandbox complements TI Lookup for unknown samples. If an URL yields no TI Lookup match, analysts can submit it to the sandbox and receive a full behavioral report (process tree, network activity, file system changes, and ATT&CK technique tags) in minutes.
Unlike automated sandboxes that process samples silently, ANY.RUN lets analysts interact with the execution — clicking through prompts, observing network connections, and watching process trees unfold — while the sandbox maps every observed behavior to MITRE ATT&CK techniques in real time.
Business objective: Reduce mean triage time per alert. Decrease false positive escalations. Increase analyst capacity without headcount growth, enabling the SOC to handle greater alert volume at the same staffing level.
3. Incident Response: From Labels to Action
MITRE ATT&CK gives incident responders a structured model for understanding what an adversary may have done across the kill chain. It offers a common language and playbooks for containment, full visibility into attacker actions for precise, minimal-disruption response. This is genuinely valuable for architecting investigations and communicating findings to stakeholders.
What the SOC Actually Needs
During an active incident, responders need execution context. Which processes ran? In which order? What registry keys were modified? Which files were dropped and where? Which internal hosts did the malware beacon to? Without this granular execution responders end up remediating visible symptoms while the attacker maintains persistence through overlooked footholds.
Solution: Compress Containment Time with Complete Execution Context
Interactive Sandbox generates a complete execution timeline for any submitted sample: full process trees (parent/child relationships, command-line arguments), all network connections (DNS queries, HTTP/S requests, C2 communication patterns), file system changes (created, modified, deleted files), and registry modifications.
Every action is timestamped and tagged with the corresponding MITRE ATT&CK technique. Responders don’t need to reconstruct what malware did from endpoint telemetry alone. They have a ground-truth behavioral record from a controlled detonation.
TI Lookup accelerates the lateral movement investigation. If an incident involves a suspicious IP or domain used for C2, TI Lookup surfaces all previous ANY.RUN analyses involving that indicator. It helps reveal which malware families have used it, when, and in what context.
Business objective: Reduce mean time to contain (MTTC) by giving responders complete execution context at the start of an investigation. Decrease re-infection rates by ensuring all persistence mechanisms are documented and remediated. Reduce incident response costs by compressing investigation timelines.
4. Proactive Defense: Supercharging Threat Hunting with Real Patterns
Threat hunting (proactively searching for adversary presence that evaded automated defenses) is where MITRE ATT&CK suggests hypotheses: if you are in a financial services organization, groups like FIN7 or Carbanak are relevant threats; their documented techniques (T1059, T1027, T1547) suggest where to look in your telemetry. This starting point is invaluable.
What the SOC Actually Needs
A successful hunt requires more than “look for PowerShell abuse”. It requires the specific parent-child process relationships, the exact command-line patterns, the particular registry keys, the network destinations that real-world attackers targeting your industry have actually used recently. Generic ATT&CK-based hunt queries produce excessive noise and burn hunter time on false leads. Real attack patterns are the fuel that makes hunts productive.
Solution: Turn Hunt Hypotheses into High-Yield Findings with Real Attacker Patterns
Threat Intelligence Lookup enables hunt pivoting at scale. A hunter who identifies a suspicious process name can query TI Lookup to find all samples that share that process, discover related IOCs, identify the malware family, and extract the precise command-line patterns that family uses. This turns a single hunt lead into a comprehensive behavioral profile needed to write high-confidence hunt queries.
The combination of TI Feeds and TI Lookup transforms threat hunting from a creative exercise into an evidence-based discipline grounded in real adversary behavior.
Business objective: Increase the yield rate of threat hunts (confirmed findings per hunt hour). Identify attacker dwell time earlier, reducing the average time an adversary operates undetected inside the network. Demonstrate proactive risk reduction to board and audit stakeholders.
Conclusion: From Framework to Force Multiplier
MITRE ATT&CK has fundamentally changed how the security industry thinks about risk: from abstract control gaps to concrete adversary behaviors. For CISOs, this shift represents an opportunity to speak a language that resonates equally in the boardroom and the SOC: the language of what attackers actually do, and how prepared your organization is to detect, contain, and recover.
But the framework’s potential is only realized when it is connected to operational reality. MITRE ATT&CK without actionable threat intelligence is a map without territory. The SOC workflows that matter (monitoring, triage, incident response, and threat hunting) all require real-world adversary data to function at the speed and fidelity modern threats demand.
ANY.RUN’s threat analysis and intelligence products are purpose-built to close this gap. Together, they transform MITRE ATT&CK from a conceptual framework into an operational engine that drives measurable risk reduction across every phase of the security operations cycle.
About ANY.RUN
ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions, helps security teams detect, investigate, and respond to threats faster.
ANY.RUN solutions include Interactive Sandbox, Threat Intelligence Lookup, Threat Intelligence Feeds, and integrations for SOC workflows across SIEM, SOAR, EDR, and other security tools. Together, they help teams safely analyze suspicious links, files, and scripts, uncover phishing behavior, trace credential theft and remote access activity, and enrich investigations with real-world threat context.
Built for security-conscious organizations, ANY.RUN is SOC 2 Type II attested and supports enterprise-ready controls such as SSO, MFA, granular privacy settings, and AES-256-CBC encryption.
Trusted by more than 15,000 organizations and 600,000 security professionals worldwide, ANY.RUN gives SOC teams the visibility they need to move from uncertain alerts to evidence-based decisions.
FAQ
Can MITRE ATT&CK help me reduce cyber insurance premiums?
Yes. Demonstrating ATT&CK-mapped controls, gap closures, and proactive testing provides evidence of mature risk management, which insurers often reward with lower premiums.
What is the difference between MITRE ATT&CK detection coverage and risk reduction?
Detection coverage measures visibility into techniques; risk reduction quantifies business impact mitigation (e.g., prevented data loss or downtime) through layered defenses, response speed, and proactive measures.
How often should I reassess risk using MITRE ATT&CK?
Quarterly at minimum, or after major incidents, new threat actor campaigns, or significant environment changes. Continuous integration via feeds and hunting yields ongoing insights.
How does MITRE ATT&CK integrate with existing frameworks like NIST?
It complements them by adding adversary behavior details to NIST’s risk management processes, enabling more targeted control implementation and effectiveness measurement.
What role do ANY.RUN’s solutions play in operationalizing ATT&CK?
They provide real-world context, fresh IOCs/IOAs, and behavioral examples that make abstract TTPs immediately actionable in monitoring, triage, and hunting.
How can small teams start using MITRE ATT&CK effectively?
Begin with high-priority tactics relevant to your industry, map existing tools, use free ATT&CK Navigator, and incorporate accessible behavioral intelligence sources for quick wins in triage and response.
The post How CISOs Reduce Cyber Risk with MITRE ATT&CK appeared first on ANY.RUN’s Cybersecurity Blog.
ANY.RUN’s Cybersecurity Blog – Read More
Insights into the clustering and reuse of phone numbers in scam emails
- Cisco Talos has recently started to collect and gather intelligence around phone numbers within emails as an additional indicator of compromise (IOC). In this blog, we discuss new insights into in-the-wild phone number reuse in scam emails.
- According to Talos’ observations, the ease of API-driven provisioning makes a few VoIP providers the preferred tool for attackers, allowing for high-volume, cost-effective scam operations that are difficult to trace.
- Attackers maintain operational continuity by rotating through sequential blocks of phone numbers and utilizing strategic cool-down periods, with a median phone number lifespan of 14 days, to effectively evade reputation-based security filters.
- Threat actors try to maximize their reach by recycling the same phone numbers across diverse, seemingly unrelated lures – including varied subject lines and different attachment formats like HEIC and PDF – to impersonate multiple brands simultaneously.
- Security researchers can expose the hidden infrastructure of organized scam call centers by shifting focus from ephemeral email addresses to phone numbers, using clustering techniques to connect disparate campaigns and strengthen overall defensive postures.
Telephone-oriented attack delivery (TOAD) continues to be a prevalent tactic in modern email threats. By shifting the communication channel from email to a real-time conversation, attackers manipulate victims into disclosing sensitive information or installing malicious software.
Cisco Talos has expanded its threat intelligence capabilities to include phone numbers as a critical IOC. Our analysis covers a wide spectrum of line types, including wireless (cellular), landline, and Voice over Internet Protocol (VoIP). While scammers leverage all three, VoIP numbers are particularly prevalent due to their ease of acquisition and the difficulty of tracing them back to their origin. In fact, six of the ten largest campaigns we detected between February 26 and March 31, 2026 relied on VoIP infrastructure.
To better understand how these numbers are weaponized, this blog first explains the technical structure of VoIP numbers and the role of service providers in this ecosystem. We then broaden the scope to analyze reuse patterns, lifespan, and campaign characteristics across all line types. By sharing these insights, Talos aimsto strengthen our collective defensive posture against these evolving threats.
The structure of VoIP phone numbers
Most VoIP numbers follow the E.164 international public telecommunication numbering plan. This format ensures that every number is globally unique and can be routed correctly across the Public Switched Telephone Network (PSTN).
An E.164 number is limited to 15 digits and consists of:
- International Prefix (+): Indicates the number is in international format
- Country Code (CC): 1 to 3 digits (e.g., 1 for the US/Canada, 44 for the UK)
- Area Code/National Destination Code (NDC): Often referred to as the area code
- Subscriber Number (SN): The specific number assigned to the user or device
The above components are shown in the example phone number below:
The VoIP ecosystem
Voice over Internet Protocol (VoIP) has become the primary medium for scam campaigns due to its cost effectiveness, ease of deployment, and API-driven automation. Within this ecosystem, we identify two primary operational models: wholesalers and retailers. VoIP wholesalers (e.g., Virtue, Twilio, and Bandwidth) operate in a business-to-business (B2B) capacity, sitting between Tier 1 carriers (e.g., AT&T, Verizon) and smaller service providers, selling high volumes of numbers in bulk. Conversely, VoIP retailers (e.g., RingCentral) sell finished business calling and collaboration solutions directly to organizations and end users.
VoIP providers are further categorized into communications platform as a service (CPaaS) and unified communications as a service (UCaaS). CPaaS providers offer programmable APIs that allow developers to integrate voice and messaging directly into applications. Because these platforms are designed for automation and high-volume traffic, they are frequently exploited by threat actors for rapid, API-driven number provisioning. In contrast, UCaaS providers offer comprehensive, end-user-facing communication suites. UCaaS platforms are typically designed for legitimate enterprise collaboration, and that makes them less attractive for scamemail campaigns. Talos has found Sinch (primarily a leader in CPaaS) as the most commonly abused VoIP provider, and Verizon and NUSO as the least abused providers in the studied time window.
While VoIP line types dominate the scam landscape (see Figure 2), Talos has observed that threat actors utilize wireless (cellular) and landline numbers as well. Cellular numbers are harder to provision at scale, as they typically require physical SIM cards and stricter customer verification, making them more expensive and less disposable than VoIP numbers. Nevertheless, they are still widely adopted by scammers. Figure 3 shows the distribution of wireless carriers that are used byscammers in the studied time window. Landline numbers, on the other hand, are used to project a sense of local presence or established business legitimacy. By using a landline with a specific local area code, scammers can effectively impersonate local businesses (e.g., banks, utility companies, or government offices).
Phone number reuse and lifespan in scam campaigns
In this section, we provide insights into the lifecycle of phone numbers used in scam emails, examining how often they are reused, their typical lifespan, and how they appear across seemingly unrelated lures. Our analysis focuses on scam campaigns impersonating popular brands, including PayPal, Geek Squad (Best Buy), McAfee, and Norton LifeLock.
Phone number reuse patterns
Talos identified 1,652 unique phone numbers across these campaigns during the studied time window (February 26 to March 31). Of these, 57 numbers (approximately 3.4%) were reused across multiple consecutive days. The longest period of reuse observed for a single phone number was four consecutive days.
As discussed in a previous blog post, phone numbers are reused for several strategic reasons. First, intelligence regarding phone numbers is often distributed more slowly than that of URLs or file hashes; many numbers remain under the radar of third-party reputation services for several days. Second, reuse offers logistical advantages for scam call centers, allowing them to maintain a consistent brand presence for multi-stage social engineering, callback scheduling, and persistent victim engagement. Finally, reuse minimizes operational costs, particularly for paid VoIP services. While we observed some phone numbers reused for up to four consecutive days, the most common reuse period was two consecutive days.
Lifespan analysis and cool-down periods
Scammers do not always reuse phone numbers on consecutive days. Often, they implement a cool-down period — pausing the use of a number for a few days to evade detection — before reintroducing it into a campaign.
Our investigation into the lifespan of these numbers revealed that 108 phone numbers (~6.5%) remained active for more than one day. As shown in Figure 4, most phone numbers have a lifespan of two to six days, though a handful remained active for nearly a month. During the study window, the median lifespan was approximately 14 days. Notably, infrastructure longevity often correlates with the impersonated brand; as illustrated in Figure 5, PayPal-themed scam campaigns utilized significantly more persistent phone numbers than those impersonating Norton LifeLock.
Phone numbers across unrelated lures
A scam or phishing lure is typically a combination of a business context, a psychological trigger, a call-to-action, and an impersonated brand (see Table 1 for a few examples). These lures appear across various email layers, including subject lines, body content, and attachments.
|
Claimed business context |
Psychological trigger |
Call-to-action |
Impersonated brand |
|
Subscription renewal Invoice or billing statement Account security alert Order confirmation/shipping issue Technical support case Refund or overpayment notice Service cancelation confirmation Financial transaction verification |
Urgency Fear/Loss aversion Confusion Relief opportunity Curiosity |
Call a phone number Click a link Reply with personal details Download/open attachment Provide payment/banking information |
PayPal Geek Squad (Best Buy) McAfee Norton LifeLock
|
Table 1. Examples of lures that most commonly appear in scam or phishing emails.
We observed phone numbers being recycled across diverse, seemingly unrelated lures:
- Using the same phone number across multiple lures in the subject line: In one campaign, a single phone number appeared across multiple business contexts, such as “order confirmation” and “financial transaction verification.” Figure 6 demonstrates how these subject lines differ, despite the emails containing the same phone number and impersonating the same brand.
Figure 6. Four scam emails with completely different subject lines that contain the same phone number.
- Using the same phone number across multiple document-based lures: In a second campaign, a single phone number was embedded in PDF attachments used for both “subscription renewal” and “financial transaction verification.”Interestingly, this campaign utilized two different brands — PayPal and Norton LifeLock — to redirect recipients to the same call center, leveraging urgency as a psychological trigger.
Figure 7. Two scam emails with different body contents that contain the same phone number while impersonating different brands.
- Using the same phone number across multiple attachment file formats: In a third campaign, a single phone number was embedded in two different attachment formats: HEIC and JPEG. The use of HEIC (High Efficiency Image Container) — a format often used for iPhone/iPad photos — demonstrates the attackers’ efforts to bypass traditional file-based detection while maintaining high image quality. Talos has observed campaigns utilizing even more attachment types, confirming that threat actors frequently distribute a single phone number across multiple attack vectors to maximize their reach.
Figure 8. Two scam emails with different attachment file types that contain the same phone number while impersonating the same brand.
Phone block-level clustering
In the context of scam emails and related smishing or callback scams, attackers utilize specific VoIP grouping and clustering techniques to bypass security filters, appear legitimate, and maintain high-volume operations. One of the most common tactics is sequential number grouping. Scammers often obtain large ranges of sequential phone numbers by purchasing Direct Inward Dialing (DID) blocks. Consequently, if a specific number is flagged as spam and blocked by a carrier, the attackers simply rotate to the next number in the block.
The figure below shows how a block of numbers — differing only in the last four digits — is used in various scam emails impersonating PayPal between March 3 and March 6, 2026. It is also clear that certain numbers are used in larger campaigns than others; for instance, “+1 804[-]713[-]4598” was used in 117 scam emails in a single day.
In large-scale scam campaigns, phone numbers within a single sequential block are reused across multiple brand lures. The figure below shows how a range of numbers in a sequential block is deployed across three different brand lures. As with the previous case, some phone numbers are utilized in significantly larger campaign volumes than others.
Conclusion and protection
When tracking scam campaigns, it is essential to look beyond individual sender email addresses, which are often ephemeral. Instead, it is more strategic to focus on phone numbers, which serve as the true anchors of the operation. By clustering scam lures based on shared phone numbers, security researchers can effectively map connections between seemingly unrelated campaigns, ultimately exposing the infrastructure of organized criminal call centers.
Service providers and security teams should prioritize the implementation of real-time reputation monitoring for different communication channels to proactively mitigate these threats. For example, establishing centralized databases that track and flag high-risk phone numbers across multiple platforms allows for rapid cross-campaign correlation. Collaboration between telecommunications and VoIP providers is also vital, as sharing threat intelligence regarding malicious telephony infrastructure enables an industry-wide defense against the persistent threat of social engineering and fraud.
Cisco Secure Email Threat Defense
Protecting against these sophisticated and devious threats requires a comprehensive email security solution that harnesses AI-powered detections. Cisco Secure Email Threat Defense utilizes unique deep and machine learning models, including Natural Language Processing, in its advanced threat detection systems that leverage multiple engines. These simultaneously evaluate different portions of an incoming email to uncover known, emerging, and targeted threats.
Secure Email Threat Defense identifies malicious techniques used in attacks targeting your organization, derives unparalleled context for specific business risks, provides searchable threat telemetry, and categorizes threats to understand which parts of your organization are most vulnerable to attack. You can sign up for a free trial of Email Threat Defense today.
Cisco Talos Blog – Read More
Palo Alto PAN-OS Flaw Under Active Exploitation Enables Remote Code Execution
Palo Alto Networks has released an advisory warning that a critical buffer overflow vulnerability in its PAN-OS software has been exploited in the wild.
The vulnerability, tracked as CVE-2026-0300, has been described as a case of unauthenticated remote code execution. It carries a CVSS score of 9.3 if the User-ID Authentication Portal is configured to enable access from the internet or any
The Hacker News – Read More
Massive “Low and Slow” DDoS Attack Hits Platform With 2.45 Billion in 5 Hours
DataDome researchers uncovered a massive low and slow DDoS attack that delivered 2.45 billion requests using 1.2 million IP addresses.
Hackread – Cybersecurity News, Data Breaches, AI and More – Read More