Your phone rings. The caller says they’re from IT. They tell you your account needs a quick security update today, and they’ll walk you through it. Do you trust them?
If you run a business or work for one, that question matters right now. On October 28, 2026, the Canadian Centre for Cyber Security (the Cyber Centre) put out Alert AL26-028 about an ongoing voice phishing campaign, also called vishing, aimed at Canadian organizations. The callers pretend to be internal IT or help desk staff.
What’s happening
The Cyber Centre says multiple Canadian firms have been targeted, including organizations in the legal and financial sectors. Activity in October was concentrated on the legal sector. The alert ties the methods to a financially motivated threat actor that has been publicly reported on. It doesn’t name one in the alert text, so I won’t guess.
The alert is written for IT professionals. But nothing in it needs a big IT department to defend against. Most of the defence is a few rules and a habit.
How the call works
Here is the sequence the Cyber Centre describes.
- The call. The caller claims there’s an urgent passkey migration, MFA enrolment or password change that has to happen. The call can come to a personal mobile, an office phone or Microsoft Teams. The caller ID may be spoofed to look like your real help desk number.
- The credibility tricks. Callers may mention real internal IT staff or missed deadlines to sound legitimate. They may also hang up if the employee tries to verify them independently.
- The fake sign-in page. The caller sends the employee to a page branded with the organization’s name, built to look like an enrolment portal. The alert gives examples of the pattern: the company name placed in front of a generic domain, or built into a newly registered domain. These domains tend to mix action words like “enroll,” “register” or “activate” with terms like “passkey,” “sso,” “mfa” or “portal.”
- The relay. This is the part that surprises people. The fake page passes your password and your MFA response straight to the real sign-in service in real time. The attacker ends up with a logged-in session. The Cyber Centre says this gets around conventional MFA.
So “I have MFA turned on” is not a complete answer. If you type your password and approve the prompt on a page the attacker controls, the attacker gets in right behind you.
What the attacker does once inside
The alert says the actor has been reported to do the following after getting a session:
- Register their own MFA methods or devices so they keep access.
- Delete password-reset, MFA-change and security notification emails, and reset passwords for apps that don’t use single sign-on.
- Use scripts and Microsoft Graph to pull data out of Microsoft 365 and connected apps, including SharePoint and OneDrive.
- Send extortion demands after stealing data.
Deleting the security emails is the detail I’d underline. It’s designed to keep you from noticing.
How to tell if this affects you
The campaign has named Canadian organizations since January, and since July it has increasingly gone after finance and legal. If you’re a bookkeeper, accountant, lawyer, advisor, or you handle client money or files, assume you’re on the list of attractive targets. If you use Microsoft 365, the data it goes after is in your account.
You are also exposed if any staff can be talked into a password or MFA change over the phone. Ask yourself two questions:
- If someone called my receptionist as “IT” and asked for an MFA reset, what would happen?
- Do my people know they’re allowed to hang up on IT?
If either answer makes you uneasy, start with the steps below.
What to do today
1. Make one rule: nobody changes MFA because of an inbound call. The Cyber Centre recommends telling employees to independently verify any unexpected IT call about MFA, passkeys or password changes, regardless of caller ID or urgency. In practice that means: hang up, then call back on a number you already had, such as the staff directory or your IT provider’s number on your contract. Don’t use a number the caller gave you. Don’t reply in the same Teams chat.
2. Give people permission to hang up. The alert notes callers may end the call if you try to verify them. That is a warning sign in itself. A real IT person will be fine with a callback. Tell staff plainly that nobody gets in trouble for hanging up on a real IT call, and that they will be thanked for it.
3. Write down your MFA reset and account recovery rules. The Cyber Centre says to strengthen verification for MFA resets, account recovery and new device enrolments. For a small business, this can fit on one page:
- Reset requests are verified by calling the person back on a number you already hold, not the one the request came from.
- A second person approves resets for owners, admins and anyone with access to client or financial data.
- Whoever handles a reset records who asked, who approved and when.
- The person told afterward that a new device or method was added is the account owner, through a channel the attacker doesn’t control.
These are my suggestions for how to apply the alert, not wording from it. The point is that no single phone call can finish a reset.
4. Move toward phishing-resistant MFA. The alert recommends FIDO2 security keys, device-bound passkeys or platform authenticators, especially for privileged and high-risk users. These are harder to relay through a fake page than a typed code or an approve button. Start with the owner and anyone with admin rights.
5. Tighten sign-in conditions. The Cyber Centre recommends conditional access that requires managed devices, and restricting sign-ins from commercial VPNs, hosting providers and residential proxies. It also suggests shorter session lifetimes. If someone else manages your Microsoft 365, ask them whether these are in place.
6. Limit who can contact you on Teams. The alert says to restrict external calls, direct messages and meeting invites in collaboration platforms to trusted or required outside users, and to review guest access. A fake “IT” Teams message from outside your company shouldn’t land in the first place.
7. Set up a way to report. Give staff one easy place to report suspicious calls and websites, even if it’s just “tell the owner.” Reports are how you spot that a second person got the same call.
8. Don’t trust links from callers. Never sign in through a page someone on the phone sends you. Use the bookmark or app you normally use. If you’re self-employed with no IT department, any call from “your IT support” deserves extra suspicion. Hang up and contact your actual provider on your own.
Signs something already went wrong
If someone took the call and followed the instructions, treat it as a compromise until proven otherwise. The alert points to these signals worth watching for:
- MFA methods or devices on the account that the person doesn’t recognize.
- Password-reset, MFA-change or security emails that have disappeared.
- Unusual, high-volume or scripted access to files in SharePoint or OneDrive.
- Look-alike domains using your company’s name.
- An extortion message.
If an analyst reviews sign-in activity for an account like this, the standard first look is for sign-ins from unexpected locations or hosting providers, and for new authentication methods added around the time of the call.
If you suspect compromise, the Cyber Centre’s guidance is to revoke active sessions and tokens, reset credentials, remove unauthorized MFA methods or devices, and review mailbox and file activity. Resetting the password alone isn’t enough, because the attacker may have added their own MFA method. Keep your identity provider and Microsoft 365 audit logs so they can be investigated.
When to get help
If you see any of the signs above, don’t try to quietly clean it up yourself. Deleting things can destroy the evidence you need. Bring in whoever manages your Microsoft 365 or your IT, and do it the same day.
The Cyber Centre also asks organizations that find activity matching this alert to report it through My Cyber Portal or by email to contact@cyber.gc.ca.
