# AI-Accelerated Phone Scam (Vishing/TOAD) Campaigns Impersonating Amazon, Microsoft, PayPal, Norton, GitHub, Canva, Geek Squad, Temu, Target and the FTC

> Cofense reports mass phishing email campaigns impersonating well-known brands (Amazon, Microsoft, Target, PayPal, Norton, GitHub, Canva, Geek Squad, Temu, FTC) that lure victims into calling attacker-controlled VoIP numbers over fake unauthorized-purchase or account-issue alerts. Low-skill threat actors use AI tools to rapidly generate polymorphic message variants, overwhelming traditional email security, with more advanced variants (Geek Squad) embedding operational GitHub links that redirect to a fake invoice.

- **Published:** 2026-08-17T00:00:00Z
- **Last reviewed:** 2026-08-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2042
- **ID:** TL-2026-2042
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This is a Telephone-Oriented Attack Delivery (TOAD), also called callback-phishing or vishing, campaign documented by Cofense on 2026-08-17. Rather than embedding a malicious link or attachment, the phishing emails present a fabricated unauthorized-purchase notice or password-reset alert for a trusted brand and instruct the recipient to call an included VoIP phone number to resolve it. Because the recipient dials the number themselves believing they are reaching the legitimate company, they are psychologically primed to comply once a scammer answers -- a well-documented TOAD dynamic that lets attackers bypass content-based email defenses entirely and maintain direct control of the interaction.

Cofense identifies the campaign's low barrier to entry: operators need only "a free email address, a text or photo editor, and a free Voice over Internet Protocol (VoIP) number," and now increasingly lean on generative AI to "rapidly generate countless variations of the same scam," producing polymorphic lures that defeat pattern- and signature-based email security. A more advanced Geek Squad-themed variant goes further, embedding an operational GitHub link that redirects the victim to a fake invoice page before funneling them to the phone channel -- layering a legitimate, trusted web service (GitHub) on top of the phone-based pretext.

The underlying TOAD/callback-phishing technique class is independently and extensively documented by industry and government sources. Cisco Talos tracked the ten largest telephone-oriented scam campaigns between 2026-02-26 and 2026-03-31 and catalogued 1,652 unique abused phone numbers impersonating PayPal, Geek Squad, McAfee, and Norton LifeLock -- six of the ten campaigns ran entirely on disposable VoIP numbers provisioned through CPaaS platforms (Sinch was the most abused) and abandoned within days, before reputation-based blocklists could flag them. Trustwave/LevelBlue SpiderLabs separately documented a 140% surge in callback-phishing volume in mid-to-late 2024, naming Microsoft, Norton LifeLock, PayPal, DocuSign, and Geek Squad among the most-impersonated brands -- largely the same brand set this campaign reuses. The FTC has repeatedly warned consumers that legitimate companies never require a customer to call a number found in an unsolicited email or pop-up, and that doing so is the entry point into tech-support-scam and callback-phishing fraud. Once a victim calls, publicly documented TOAD kill-chains show operators commonly walk them through installing consumer remote-access software (e.g. AnyDesk, TeamViewer), after which the attacker pursues credential theft, account takeover, or direct financial theft (gift cards, wire transfers, cryptocurrency).

No CVE, malware payload, or technical network/file IOCs are published in the Cofense source article; the threat is a pure social-engineering/fraud campaign rather than a software-exploitation event, consistent with the MEDIUM severity and hunt rationale (campaign scale and AI-driven evasion, not a technical exploitation trigger).

## MITRE ATT&CK

- T1566.004 Spearphishing Voice
- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1684.001 Impersonation
- T1585.002 Email Accounts
- T1583.006 Web Services
- T1588.007 Artificial Intelligence
- T1219 Remote Access Tools
- T1657 Financial Theft

## Sources

- [Phonescams: Casting a Wide Net in an Orchard of Low-Hanging Fruit](https://cofense.com/blog/phonescams-casting-a-wide-net-in-an-orchard-of-low-hanging-fruit)
- [Insights into the clustering and reuse of phone numbers in scam emails](https://blog.talosintelligence.com/insights-into-the-clustering-and-reuse-of-phone-numbers-in-scam-emails/)
- [Hooked by the Call: A Deep Dive into The Tricks Used in Callback Phishing Emails](https://www.levelblue.com/blogs/spiderlabs-blog/hooked-by-the-call-a-deep-dive-into-the-tricks-used-in-callback-phishing-emails)
- [What is Callback Phishing (TOAD)?](https://ironscales.com/glossary/callback-phishing)
- [Phishing: Spearphishing Voice, Sub-technique T1566.004](https://attack.mitre.org/techniques/T1566/004/)
- [Obtain Capabilities: Artificial Intelligence, Sub-technique T1588.007](https://attack.mitre.org/techniques/T1588/007/)
- [Social Engineering: Impersonation, Sub-technique T1684.001](https://attack.mitre.org/techniques/T1684/001/)
- [Financial Theft, Technique T1657](https://attack.mitre.org/techniques/T1657/)
- [How To Spot, Avoid, and Report Tech Support Scams](https://consumer.ftc.gov/articles/how-spot-avoid-and-report-tech-support-scams)
- [Seemingly urgent security messages could lead to tech support scams](https://consumer.ftc.gov/consumer-alerts/2025/04/seemingly-urgent-security-messages-could-lead-tech-support-scams)
- [Hackers Using PDFs to Impersonate Microsoft, DocuSign, and More in Callback Phishing Campaigns](https://thehackernews.com/2025/07/hackers-using-pdfs-to-impersonate.html)
- [Geek Squad Email Scam: Fake Invoice and Renewal Warning (2026)](https://blog.gridinsoft.com/geek-squad-email-scam/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2042