# Google Account Security Team Impersonation Vishing Campaign — Telegram Recruitment Ad Leaks Call Script

> Trellix Advanced Research Center's Dark Web Roast (August 2026 edition) surfaced a Telegram recruitment ad — posted by "Derian" (@crɑick) in the "UK Fraudsters" channel — hiring US/Canada-based, 'white sounding' callers for a voice-phishing (vishing) operation impersonating Google's Account Security Team. The ad demanded 'NO SCRIPT READING' while printing the exact required opener, which falsely claims the call is on a 'recorded line' from Google. The Register (2026-09-25) broke the story, tying it to a broader 2025-2026 surge in vishing-as-initial-access and dark-web recruitment for social engineers.

- **Published:** 2026-09-25T00:00:00Z
- **Last reviewed:** 2026-09-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2695
- **ID:** TL-2026-2695
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** Derian
- **Detections:** 9 · **IOCs:** 5 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In the August 2026 edition of its "Dark Web Roast" series, Trellix's Advanced Research Center identified a hiring post in the Telegram channel "UK Fraudsters" from a user going by "Derian" (handle @crɑick). The ad, titled "Hiring - Female/Male Mail Callers," sought USA/Canada-based applicants with a "white sounding" voice and stated in bold, "NO SCRIPT READING" — immediately followed by the exact call script applicants were required to use. That script opens: "Good afternoon, this is [name] reaching you on behalf of the Google Account Security Team on a recorded line. Am I speaking with [target name]?" (the leaked example used the name "Larry Boyles"), indicating callers are handed pre-researched target names rather than cold-dialing at random.

The scam pattern the script is built to execute is independently documented by Google itself: Google's official scam-warning FAQ (support.google.com/faqs/answer/17170932) describes callers impersonating Google Security who claim an account "has been compromised or hacked," then ask the victim to read back a verification code or approve a device/recovery prompt "over the phone" — while Google states flatly that it "will never call you about your account security." Independent technical breakdowns of this exact scam (e.g., Caldera Cybersecurity) describe the caller simultaneously triggering a genuine Google account-recovery or MFA prompt during the call so the victim receives an authentic-looking notification that appears to corroborate the caller's claims; once the victim reads back the code or approves the prompt, the attacker changes the account's recovery email and phone number, locking the legitimate owner out.

No technical network/file IOCs (phone numbers, calling infrastructure, domains, malware) were disclosed in the source reporting — this is a labor-recruitment ad for a social-engineering operation, not a leaked technical intrusion set. The find is contextualized against a documented surge: Google's own Threat Intelligence Group/Mandiant data (cited via The Register's March 2026 vishing feature and the Google Cloud Threat Horizons reporting) found voice phishing became the second-most-common initial access vector overall in 2025 (11%, versus ~8 hours-to-22-seconds initial-access handoff acceleration) and the single most common vector for cloud-environment intrusions (23%). ReliaQuest independently documented that dark-web job postings seeking English-speaking social-engineering skill more than doubled between 2024 and 2025, corroborating Trellix VP John Fokker's on-record observation of a rising trend in social-engineering job postings. The FBI's IC3 2025 Internet Crime Report (published 2026-04-07) recorded $20.87 billion in total cyber-enabled crime losses for 2025, a 26% year-over-year increase, cited by The Register as the backdrop against which this recruitment ad should be read. Google's own June 2026 fraud and scams advisory separately documents a rise in vishing/impersonation campaigns abusing official-sounding personas to coerce victims, reinforcing that voice-based impersonation of trusted brands and authorities is an active, growing consumer-fraud vector rather than an isolated incident.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1585.001 Social Media Accounts
- T1566.004 Spearphishing Voice
- T1078 Valid Accounts
- T1684.001 Impersonation
- T1621 Multi-Factor Authentication Request Generation
- T1111 Multi-Factor Authentication Interception
- T1098 Account Manipulation
- T1098.005 Device Registration
- T1657 Financial Theft
- T1531 Account Access Removal

## Sources

- [Fake Google Security Team ad says 'no script reading' in voice phishing - then prints the script](https://www.theregister.com/security/2026/09/25/fake-google-security-team-ad-says-no-script-reading-in-voice-phishing-then-prints-the-script/5299264)
- [Dark Web Roast - August 2026 Edition](https://www.trellix.com/blogs/research/dark-web-roast-august-2026-edition/)
- [Google Account Security Scam via Phone Call](https://support.google.com/faqs/answer/17170932?hl=en)
- ["This Is Google Security…" – Don't Fall for This MFA Scam](https://calderacyber.com/this-is-google-security-dont-fall-for-this-mfa-scam/)
- [2025 IC3 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)
- [Voice phishing skyrockets as smooth crims talk their way in](https://www.theregister.com/special-features/2026/03/23/voice-phishing-skyrockets-as-smooth-crims-talk-their-way-in/5223759)
- [Help Wanted: Dark Web Job Recruitment is Up](https://securityboulevard.com/2025/08/help-wanted-dark-web-job-recruitment-is-up/)
- [Google's June 2026 frauds and scams advisory](https://blog.google/innovation-and-ai/technology/safety-security/fraud-scams-advisory-june-2026/)
- [Cybercrime groups speed up initial access handoff through planning, coordination](https://www.cybersecuritydive.com/news/cybercrime-groups-speed-initial-access/815551/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2695