Callback Phishing (TOAD) Guide: Phone-Led Attacks and Verification Controls

Callback phishing, also called telephone-oriented attack delivery (TOAD), hides the malicious step in a phone call the victim makes themselves, so the email that starts it often contains no link, no attachment and nothing an email filter can score. The lure is usually a fake invoice, subscription renewal or refund notice with a phone number, and the person who answers talks the victim into opening a remote access tool or a "support" website. This guide explains how the attack chain works, where it shows up in organisations, what it costs, how to detect it in mail, endpoint and network telemetry, and which verification and hardening controls break it. It is for email security, endpoint and service desk teams. Generic phishing is covered in the Phishing Guide and attacker-initiated calls in the Vishing and Smishing Guide.

Key takeaways

• The payload is a phone number. Callback lures move the attack off email and onto a voice channel, which defeats link rewriting, attachment sandboxing and most URL reputation checks.
• Remote access software is the usual objective. CISA, NSA and MS-ISAC documented actors running portable ScreenConnect and AnyDesk clients that need no installation or admin rights, then using the session for refund fraud.
• Help desk impersonation is the second variant. Microsoft reported Storm-1811 flooding inboxes with subscription spam, then calling or messaging over Teams as "IT Support" to get a Quick Assist session, leading to Black Basta ransomware.
• Allowlist remote access tools and remove the rest. Application control that blocks unapproved RMM tools, including portable executables, removes most of the attacker's leverage.
• Verification beats recognition. A simple rule, "IT never asks you to start a remote session you did not request, and you call back only on numbers from the directory", works better than teaching staff to spot convincing voices.

How the attack works

A callback attack splits into an email stage that looks harmless and a voice stage where the real persuasion happens. The simplified sequence below combines CISA advisory AA23-025A and Microsoft's Storm-1811 report.

1. Lure: An email, text or calendar invite claims the recipient has been charged for a subscription, antivirus renewal or purchase, often using brands such as Norton, McAfee, Geek Squad, Amazon, Microsoft or PayPal. The FTC notes these messages often set a deadline such as 24 hours. The body contains a phone number and, often, no link at all.
2. Victim calls: The victim rings to cancel or dispute. An operator offers to process the "refund".
3. Remote session: The operator directs the victim to a support domain that downloads a remote access tool, or asks them to open a built-in tool such as Microsoft Quick Assist and type in a code. In AA23-025A the first-stage executable fetched portable RMM software from a second-stage domain and connected to an actor-controlled RMM server.
4. Exploitation: In the consumer-style variant the actor asks the victim to log in to online banking during the session, edits the displayed balance to show an "excess refund" and asks the victim to send the difference back. In the enterprise variant the actor downloads tooling, harvests credentials and moves laterally.

Microsoft's Storm-1811 reporting shows a help desk variant. The actor signs the target up to large numbers of email subscriptions (email bombing), then calls, or sends Teams messages from tenants named "Help Desk" or "IT Support", offering to fix the spam. The victim opens Quick Assist, enters the actor's security code and grants control. Follow-on activity included batch and ZIP downloads via cURL or BITSAdmin, fake "spam filter update" credential prompts, Qakbot, Cobalt Strike, ScreenConnect, NetSupport Manager, an OpenSSH tunnel, SystemBC and finally Black Basta ransomware deployed with PsExec.

ATT&CK mapping

Where it shows up

• Personal and work inboxes alike: AA23-025A describes help desk-themed emails sent since at least June 2022 to both personal and government email addresses of US federal staff.
• Collaboration platforms: External Teams chats from look-alike "Help Desk" tenants replaced or followed email in the Storm-1811 activity. Microsoft advises users to check the "External" tag.
• Search and advertising: The FTC notes scammers buy search placement and ads so their numbers appear when people look for support.
• Managed service providers and IT help desks: AA23-025A warns that MSPs and help desks are frequent targets because one compromise can expose many customers. See the RMM Tool Security Guide.
• Finance and accounts payable: Invoice-themed lures land with people who are expected to act on invoices, and the call can pivot into payment redirection. See the Email Identity and BEC Guide.

Impact

Legitimate tools do most of the work. AA23-025A notes that RMM use generally does not trigger antivirus alerts, so the actor can avoid custom malware altogether.

Detection

Email and messaging

• Phone-number-only messages: Flag inbound mail from external or free-mail senders that combines a brand name (renewal, invoice, order, refund) with a phone number and no link. Where your gateway lacks a TOAD classifier, a transport rule on keywords plus a phone-number pattern, routed to quarantine review, is a start.
• PDF and image lures: Lures often place the number inside a PDF or image to avoid text scanning. Make sure optical character recognition (OCR) of attachments is enabled where your filter supports it.
• Email bombing: A sudden spike of newsletter sign-up confirmations to one mailbox is a precursor in the help desk variant. Alert on per-recipient volume anomalies and warn the user that a "help desk" call may follow.
• External Teams contact: Review external access logs for first-contact chats from tenants with display names such as "Help Desk", "IT Support" or "Security Team".

Endpoint and network

• Inventory first: AA23-025A recommends auditing remote access tools to know which RMM software is authorised. You cannot alert on "unapproved" without a list.
• Portable RMM execution: Review EDR and process creation logs (for example Windows Security Event ID 4688 with command line auditing, or Sysmon Event ID 1) for RMM binaries running from user-writable paths such as Downloads or %AppData%, and for RMM tools loaded only in memory.
• Quick Assist launches: Alert on Quick Assist process starts on corporate devices where it should be removed, and on connections to remoteassistance.support.services.microsoft.com, which Microsoft documents as the primary session endpoint.
• Follow-on tooling: cURL or BITSAdmin downloads of archives shortly after a remote session, new OpenSSH services, and PsExec use from a workstation are high-value correlations.
• Network: DNS and proxy logs for newly registered support-themed domains and for RMM vendor relay domains that your organisation does not use.

Metrics

• Share of endpoints where application control blocks unapproved RMM tools and Quick Assist.
• Number of unapproved RMM executions detected per month, and median time from execution to containment.
• Reporting rate for callback lures and suspicious support calls, measured alongside, not instead of, click or call rates. The NCSC advises measuring reports, because counting only clicks rewards staying silent.
• Share of service desk remote sessions started from the approved tool with a ticket reference (target: 100%).
• Time from first user report to tenant-wide search and purge of the same lure.

Prevention and hardening

Technical controls

In framework terms these controls sit under NIST CSF 2.0 PR.PS-05 (installation and execution of unauthorised software are prevented), PR.AT-01 (awareness and training) and DE.CM-09 (monitoring of computing hardware and software), and under NIST SP 800-53 Rev. 5 CM-7 Least Functionality, CM-11 User-installed Software, AC-17 Remote Access, SI-8 Spam Protection and AT-2(3) Social Engineering and Mining.

See the Application Allowlisting Guide and the Phishing-Resistant MFA Guide for implementation detail.

Process and verification controls

• One support channel rule: Publish that the service desk never initiates remote sessions without a ticket the user raised, and never asks users to install software or read out codes. Microsoft's own guidance is to allow a Quick Assist helper only if you initiated contact.
• Call back on known numbers: Staff verify any billing, renewal or support contact using the number in the supplier contract or the company directory, never the number in the message. The FTC and NCSC both give this advice.
• Service desk proves itself: When IT does need to call a user, give staff a way to verify the caller, such as a ticket number visible in the self-service portal or a call back through the published desk number. See the Account Recovery and Help Desk Security Guide for the reverse direction, when attackers call the desk.
• Procurement check for "renewals": Finance and staff can check whether the organisation actually holds a subscription with the named vendor.
• Disconnect and report: Tell users that hanging up and closing a remote session mid-way is always acceptable, and that reporting after a mistake will not be punished, as the NCSC recommends.

Rollout plan

1. Week 1 to 2, inventory: List every remote access tool in use, who uses it and on which devices. Pick one approved tool for the service desk and one for third-party support.
2. Week 3 to 4, audit mode: Deploy application control rules for RMM tools in audit mode, and collect events showing which unapproved tools would be blocked.
3. Week 5 to 6, pilot ring: Enforce on IT and a pilot business unit. Remove or block Quick Assist where Intune Remote Help or another tool replaces it.
4. Week 7 onward, broad enforcement: Enforce in rings across the estate. Roll back by switching the policy for a ring to audit mode if a business process breaks, and log every exception with an owner and expiry date.
5. In parallel: Add callback lures to awareness content and simulations, publish the one-support-channel rule, and enable TOAD detections or transport rules with quarantine review.

Small versus large organisations

• Small organisations without EDR: Rely on removing local admin, uninstalling Quick Assist, DNS filtering, and a short written rule for staff. If an MSP provides support, agree which tool it uses and ask it to confirm calls through a known number.
• Large organisations: Use application control with publisher rules, EDR detections for RMM binaries outside approved paths, TOAD classifiers in the email gateway, and Teams external access restrictions. Feed user reports into the Phishing Incident Response Playbook.

Lessons from incidents

• Legitimate tools need allowlists, not signatures: The October 2022 campaign CISA identified used ScreenConnect and AnyDesk, products that many organisations already run. Reputation blocking fails here; allowlisting does not.
• Portable binaries bypass install controls: AA23-025A stresses that portable executables run without administrator rights, so "users cannot install software" is not a defence on its own.
• Noise is part of the lure: Storm-1811 created the problem (email bombing) and then offered to fix it. Warn users that spam floods may precede fake help desk calls.
• Built-in tools are in scope: Quick Assist ships with Windows, so a policy that only lists third-party RMM products misses it.
• Cover both call directions: In the MGM Resorts breach the attacker called the help desk; callback attacks reverse the direction, so controls must cover both.

Practitioner checklist

• Inventory all remote access and RMM tools, and choose one approved tool per use case.
• Block unapproved RMM tools, including portable versions, with application control; test in audit mode first.
• Remove or block Microsoft Quick Assist on managed devices where another supported tool replaces it.
• Block common RMM ports and unused RMM relay domains at the perimeter and in DNS filtering.
• Enable callback or TOAD detection, including attachment OCR, and quarantine phone-number-only brand lures for review.
• Alert on email bombing spikes and first-contact external Teams chats from help desk named tenants.
• Publish the rule that IT never starts unrequested remote sessions, and that staff call back only on directory numbers.
• Require phishing-resistant MFA on critical apps so credentials gathered by phone are less useful.
• Measure report rates and RMM block coverage monthly, and run a callback scenario in phishing simulations.

Standards and references

• CISA, NSA and MS-ISAC: AA23-025A Protecting Against Malicious Use of Remote Monitoring and Management Software
• MITRE ATT&CK: Phishing: Spearphishing Voice (T1566.004)
• MITRE ATT&CK: Remote Access Tools (T1219)
• NCSC: Phishing attacks, defending your organisation
• Microsoft Threat Intelligence: Threat actors misusing Quick Assist in social engineering attacks leading to ransomware
• Microsoft Learn: Use Quick Assist to help users
• FTC: How to spot, avoid and report tech support scams
• NIST: SP 800-53 Rev. 5 (AT-2(3), CM-7, CM-11, AC-17)

Related NHI Mgmt Group resources: Vishing and Smishing Guide · RMM Tool Security Guide · Top 10 Phishing Techniques · Deepfake and AI Impersonation Guide · Security Awareness and Human Risk Management Guide