Topic starter
19/08/2026 3:57 pm
TL;DR: Vishing now routinely pairs with AiTM phishing to trick users into password resets, MFA approvals, or attacker-controlled page visits, and Push Security says these combined campaigns are being used to hijack SSO accounts across hundreds of organisations. The control problem is not just user awareness but browser-level detection, identity verification, and session-focused response.
Editorial analysis by NHI Mgmt Group, based on content published by Push Security: “Vishing”.
Key questions
Q: What breaks when vishing is combined with AiTM phishing against SSO accounts?
A: The failure is the assumption that authentication happens in a trusted, static channel.
Q: Why do combined voice-phishing and AiTM attacks cause SSO takeover?
A: They work because the attacker only needs one successful path through the identity flow.
Q: What are the signs that browser-based account takeover controls are failing?
A: Warning signs include sessions that look familiar despite originating from stolen cookies, repeated fingerprint replays, and MFA prompts that still allow access after credential theft.
Practitioner guidance
- Harden help-desk identity verification Require stronger verification steps before password resets, MFA changes, and account recovery actions so a voice call cannot by itself trigger privileged identity changes.
- Instrument browser-session telemetry for identity abuse Monitor for suspicious browser flows, token reuse, and session handoff patterns that indicate AiTM activity even when the login itself appears successful.
- Correlate identity events with support interactions Link password resets, MFA prompts, and help-desk tickets to session creation and downstream access so investigations can reconstruct the full takeover chain.
Bottom line: The article shows that vishing plus AiTM phishing can move SSO compromise past the point where password-based controls provide meaningful assurance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:35 pm
Browser-session trust, not password strength, is the control boundary this campaign exposes: once an attacker can shape the login flow in the browser, the traditional assumption that authentication equals trusted identity breaks down. The article shows why SSO protection now depends on seeing what happens inside the session, not just whether the user passed the front door. Practitioners should treat browser telemetry as an identity control surface, not an optional add-on.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Voice phishing was the most common initial infection vector in cloud intrusions in 2025 (23%) and the second most common across all intrusions (11%), according to Mandiant's M-Trends 2026.
A question worth separating out:
Q: How should organisations respond when an SSO account may have been hijacked?
A: Treat it as a session compromise first, not just a password problem. Revoke active sessions and tokens, validate recovery-channel changes, review nearby help-desk activity, and check whether the account was used to access connected SaaS applications. The goal is to stop attacker persistence before it spreads through the identity estate.
👉 Read our full editorial: Vishing and AiTM phishing are driving SSO account takeover