TL;DR: Vishing now routinely pairs with AiTM phishing to trick users into password resets, MFA approvals, or attacker-controlled page visits, and Push Security says these combined campaigns are being used to hijack SSO accounts across hundreds of organisations. The control problem is not just user awareness but browser-level detection, identity verification, and session-focused response.
At a glance
What this is: This is a threat research piece on vishing plus AiTM phishing, showing how the combined technique chain is used to hijack SSO accounts.
Why it matters: It matters because identity teams need controls that detect browser-session abuse and social engineering together, not as separate problems.
Context
Vishing is voice phishing that uses phone calls to pressure a target into an unsafe identity action. In this case, the article ties that social engineering step to AiTM phishing, where an attacker stands in the middle of the login flow and captures what the user submits or approves.
The governance gap is not limited to human judgment. SSO account takeover now depends on how well organisations can detect browser-mediated identity abuse, validate help-desk interactions, and respond to compromised sessions before they become durable access paths.
Key questions
Q: What breaks when vishing is combined with AiTM phishing against SSO accounts?
A: The failure is the assumption that authentication happens in a trusted, static channel. When voice social engineering and AiTM phishing are combined, the attacker can steer the victim through login, MFA and session capture in real time, bypassing controls that expect a user to authenticate once and remain safe.
Q: Why do combined voice-phishing and AiTM attacks cause SSO takeover?
A: They work because the attacker only needs one successful path through the identity flow. Voice phishing creates urgency and legitimacy, while AiTM captures the authenticated browser session or token. The result is account access that looks normal to the identity provider but is already under attacker control.
Q: What are the signs that browser-based account takeover controls are failing?
A: Warning signs include sessions that look familiar despite originating from stolen cookies, repeated fingerprint replays, and MFA prompts that still allow access after credential theft. If a control accepts cloned browser properties, modified headers, or replayed device profiles as genuine, it is not distinguishing authentic traffic from fraud. That is a control gap, not a tuning issue.
Q: How should organisations respond when an SSO account may have been hijacked?
A: Treat it as a session compromise first, not just a password problem. Revoke active sessions and tokens, validate recovery-channel changes, review nearby help-desk activity, and check whether the account was used to access connected SaaS applications. The goal is to stop attacker persistence before it spreads through the identity estate.
Technical breakdown
How vishing creates the initial identity foothold
Voice phishing succeeds by redirecting trust away from the formal authentication channel and toward an attacker-controlled conversation. The target is asked to reset a password, approve MFA, or open a page that looks routine but is designed to hand over control. The key mechanism is not malware delivery. It is identity delegation through persuasion, which bypasses controls that assume the user can reliably judge the request at the moment it arrives.
Practical implication: treat help-desk workflows, password resets, and MFA recovery paths as attack surfaces, not just support processes.
Why AiTM phishing turns login success into session theft
AiTM phishing places the attacker between the user and the real identity provider, allowing the login to appear legitimate while the attacker captures the authenticated session outcome. That is why these campaigns are so effective against SSO environments: the attacker does not need to crack the password if they can intercept the browser flow, harvest tokens, or replay the authenticated session. The failure mode is session compromise after apparent authentication success.
Practical implication: monitor for browser-session anomalies and token abuse, not only failed logins.
Why combined campaigns defeat single-control thinking
The vishing step handles persuasion while AiTM handles technical capture, so the attack chain spans human, browser, and identity layers. Organisations that optimise only for MFA strength, only for awareness training, or only for endpoint detection miss the way the chain composes. The article’s core lesson is that account takeover is now a multi-stage identity abuse pattern, not a single control failure.
Practical implication: align identity verification, browser telemetry, and incident response around one shared account-takeover playbook.
Threat narrative
Attacker objective: The attacker’s objective is durable SSO account takeover that can be used to access downstream applications and impersonate the victim at scale.
- Entry begins with a vishing call that impersonates IT support, a help desk, or another trusted internal role to steer the target into an unsafe identity action.
- Credential or session capture follows when the user is pushed into password reset, MFA approval, or an attacker-controlled login page that can relay authentication to the real service.
- Impact occurs when the attacker uses the resulting SSO access to take over the account and operate as the victim across connected applications.
Breaches seen in the wild
- Gitloker GitHub extortion campaign: Phishing via GitHub notifications tricked developers into authorising malicious OAuth apps; Gitloker then wiped repos and demanded contact.
- SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Browser-session trust, not password strength, is the control boundary this campaign exposes: once an attacker can shape the login flow in the browser, the traditional assumption that authentication equals trusted identity breaks down. The article shows why SSO protection now depends on seeing what happens inside the session, not just whether the user passed the front door. Practitioners should treat browser telemetry as an identity control surface, not an optional add-on.
Voice phishing and AiTM phishing form a single governance problem, not two separate threats: the first exploits human trust formation, the second exploits authenticated session mechanics. That combination means identity security programmes need to connect help-desk assurance, browser-layer detection, and incident response into one operating model. The practitioner takeaway is that social engineering controls and session controls now rise and fall together.
Identity verification has become a runtime control, not a one-time awareness exercise: the attacker is not trying to convince the user in the abstract, but to get a specific privileged action completed under time pressure. That makes trust calibration inside support and recovery flows more important than generic security training. Security teams should assume the attacker will target the weakest human-mediated decision point in the access chain.
SSO compromise is increasingly an orchestration problem across browser, identity provider, and support channels: the real gap is not any single weak factor, but the absence of a shared detection and response model for coordinated account takeover. Push Security’s analysis reinforces that defenders need to correlate identity events with browser activity and support interactions. The practical conclusion is to govern account takeover as a cross-control workflow, not a point solution problem.
From our research library:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Voice phishing was the most common initial infection vector in cloud intrusions in 2025 (23%) and the second most common across all intrusions (11%), according to Mandiant's M-Trends 2026.
- Read next: Ultimate Guide to NHIs — Key Research and Survey Results
What this signals
Browser-session detection is now part of identity governance: teams that still separate IAM from browser security are leaving a blind spot where attacker-in-the-middle flows can succeed even after MFA. The practical shift is to govern the session, not only the credential, because the login boundary is no longer the end of the attack path.
Service desk and recovery workflows deserve the same scrutiny as sign-in policy because attackers are using them to trigger the very identity changes that create account takeover. That means joining identity assurance, browser telemetry, and response workflows into one control plane for high-risk users and privileged accounts.
For practitioners
- Harden help-desk identity verification Require stronger verification steps before password resets, MFA changes, and account recovery actions so a voice call cannot by itself trigger privileged identity changes.
- Instrument browser-session telemetry for identity abuse Monitor for suspicious browser flows, token reuse, and session handoff patterns that indicate AiTM activity even when the login itself appears successful.
- Correlate identity events with support interactions Link password resets, MFA prompts, and help-desk tickets to session creation and downstream access so investigations can reconstruct the full takeover chain.
- Contain suspicious SSO sessions fast Build response steps that isolate active sessions, revoke tokens, and re-check recovery channels when a user reports unexpected prompts, resets, or account behaviour.
Key takeaways
- The article shows that vishing plus AiTM phishing can move SSO compromise past the point where password-based controls provide meaningful assurance.
- The attack chain spans human persuasion, browser-session capture, and downstream access, which makes single-control defences insufficient.
- Organisations need stronger identity verification, better browser telemetry, and response playbooks that assume active session theft rather than only credential theft.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The article centres on authentication flows being subverted through phishing and AiTM relay. |
| NHI-10 — Human Use of NHI | The attack exploits human-mediated actions to trigger identity changes and session compromise. | |
| Recommendation — Harden authentication paths that can be replayed or relayed through attacker-controlled browser sessions. Restrict human-mediated recovery actions that can alter or expose non-human session-bearing access paths. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | SSO takeover changes authorisation state and downstream access across connected services. |
| Recommendation — Review access permissions and session authorisations whenever account-recovery activity looks abnormal. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | The campaign combines credential capture with downstream movement through SSO-enabled access. |
| Recommendation — Map vishing-plus-AiTM activity to credential access and lateral movement detections in your monitoring stack. | ||
Key terms
- Vishing: Voice phishing is a social engineering technique that uses phone calls or voice channels to persuade a target to reveal information or approve access. It succeeds by exploiting trust, urgency, and procedural shortcuts, often bypassing technical controls that would have stopped a direct login attack.
- AiTM Phishing: Adversary-in-the-middle phishing inserts attacker infrastructure between the victim and the real login service. The attacker relays the login in real time, captures the issued token, and bypasses MFA by stealing the authenticated session rather than guessing the password.
- Session Hijacking: Session hijacking is the takeover of an authenticated session after the original login has completed. The attacker does not need to know the password if they can use the active session token, which is why session monitoring and revocation are essential controls in SaaS identity governance.
- Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on August 19, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org