A social engineering pattern that combines voice impersonation with another attack channel, usually a phishing page or login relay. The call is used to build trust and steer the victim through the authentication steps the attacker needs, making the compromise harder to spot with email-centric controls.
How hybrid vishing works
Hybrid vishing blends a live voice pretext with a second channel that advances the compromise, usually by pushing the target to a fake login page, a consent screen, or a credential relay. The call supplies urgency, legitimacy, and human pressure; the follow-on channel captures the action the attacker needs.
This pattern is effective because the voice interaction changes the victim’s expectations. A person who has just spoken to a convincing “support” caller is more likely to treat the next step as routine verification, which is why these campaigns often bypass defenses that look only at email or static links.
Why the blended channel is harder to stop
Hybrid vishing is not simply “phone phishing.” It is a coordination problem in which the attacker uses one channel to create trust and another to harvest the actual access artifact. That can mean a password, a one-time code, a session token, an OAuth approval, or a help desk workflow that yields account reset or enrollment.
The combination matters because each channel compensates for the weaknesses of the other. Voice adds immediacy and social pressure, while the web or relay step captures machine-readable credentials and actions that can be replayed or used to complete authentication.
That is why real campaigns often pair vishing with compromised account workflows, MFA fatigue, fake support portals, or malicious connected-app approvals. NHIMG’s MGM Resorts breach 2023 and Cisco Yanluowang breach 2022 show how a call can be the entry point to higher-value access.
Common attack chain patterns
Hybrid vishing usually follows a small number of repeatable patterns. The caller impersonates IT support, a bank, a SaaS provider, or an executive assistant, then steers the victim to a fake portal or asks them to read back or approve an authentication step. In some cases the attacker relays the session in real time; in others, the goal is to get the victim to authorize an action that looks benign on the screen but is operationally dangerous.
Because the second stage is often interactive, the attacker can adapt mid-call. If the victim hesitates, the pretext is adjusted, a supervisor is introduced, or a warning about account suspension is added. This makes the technique more resilient than a single static lure.
Hybrid vishing also intersects with third-party trust. A help desk, outsourced support team, or vendor relationship can become the weak point when identity checks are too permissive or too script-driven. Caesars Entertainment breach 2023 illustrates how support-channel manipulation can lead to material loss even when the initial interaction seems ordinary.
How defenders should think about the control problem
The defensive issue is not only caller fraud, it is the handoff from human trust to authentication or authorization. If the victim can be convinced to complete a step that the environment treats as legitimate, the social engineering has become an access-control failure as well as a deception event.
That means hybrid vishing should be understood as a cross-channel identity attack, not a standalone telephony nuisance. A caller may never “hack” a system directly, yet still cause the user to reveal, approve, enroll, reset, or delegate the access the attacker needs. Deepfakes, Social Engineering and AI Impersonation Guide is useful context because the same trust breakdown appears in voice impersonation, even when the voice is human rather than synthetic.
Risk and Threat Considerations
Hybrid vishing is risky because it converts a conversational pretext into a direct access path. The attacker is not just trying to fool a person, they are trying to get the victim to complete an authentication, approval, or reset step that can survive beyond the call itself.
Failure mechanism: A convincing voice pretext lowers suspicion long enough for the victim to submit credentials, approve a login, enroll a device, or confirm a session in the attacker’s relay flow.
Impact: The result can be account takeover, help desk compromise, unauthorized SaaS access, lateral movement, data theft, or follow-on ransomware and extortion.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Hybrid vishing targets passwords, codes, and reset flows used to authenticate users. |
| IA-2 — Identification and Authentication (Organizational Users) | The attack relies on weakening or bypassing user authentication steps. | |
| AC-7 — Unsuccessful Logon Attempts | Hybrid vishing often pairs social engineering with repeated login attempts and MFA fatigue. | |
| Recommendation — Harden authenticator handling and restrict reset paths that can be abused by voice social engineering. Require stronger user authentication and verify risky changes through separate channels. Limit repeated authentication attempts and alert on abnormal failed-login patterns. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Hybrid vishing commonly uses deceptive steps to capture or relay authentication material. |
| NHI-10 — Human Use of NHI | The pattern abuses human operators to complete actions on behalf of the attacker. | |
| Recommendation — Reduce reliance on easily relayed auth flows and prefer phishing-resistant verification. Prevent staff from performing NHI credential or approval actions based only on a phone request. | ||
| MITRE ATT&CK | T1566 — Phishing | Hybrid vishing is a phishing variant that blends voice with another lure channel. |
| T1110 — Brute Force | Many hybrid vishing campaigns exploit repeated authentication prompts and MFA fatigue. | |
| Recommendation — Map hybrid vishing to phishing detections and correlate the voice step with follow-on access activity. Detect repeated authentication prompts and investigate MFA abuse patterns. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | When the attack relays sessions or tokens, broken authentication becomes the abuse path. |
| Recommendation — Verify token, session, and login handling against relay and replay abuse scenarios. | ||
Practitioner Guidance
Why practitioners should care: Hybrid vishing succeeds when the organisation trusts the channel more than the step being taken. The practical question is whether the next action in the workflow is safe even if the caller is not.
What to watch for: Escalation calls that demand urgency, request a one-time code, redirect to a login page, or ask support staff to bypass normal identity checks deserve suspicion because they target the junction between human persuasion and access control.
Practitioner takeaway: Treat voice-mediated verification as an entry point into authentication risk, not as a separate awareness problem.
Related resources from NHI Mgmt Group
- What is the difference between a rules-based secret scanner and a hybrid scanner?
- Why do static credentials create more risk in hybrid infrastructure?
- How can organisations secure third-party privileged access in hybrid environments?
- How should teams govern access across hybrid IAM and GRC environments?