Threat reportPhishingTL-2026-3465
Phonescams (TOAD): Email-Spoofed Brand Impersonation Driving Victims to Scam Phone Numbers
Phonescams (TOAD) (TL-2026-3465), also tracked as Phonescams, is a medium-severity phishing campaign, first published 2026-10-14. It has no confirmed attribution, affects Multiple (brand impersonation) Email users and organizations targeted, maps to 9 MITRE ATT&CK techniques (T1204, T1219, T1566), and is covered by 9 detection rules and 22 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 9MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 22Indicators of compromise
Key facts for TL-2026-3465
- Threat ID
- TL-2026-3465
- Also known as
- Phonescams, TOAD, Telephone-Oriented Attack Delivery, Callback phishing
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- general consumers, enterprise, technology, retail, finance
- Target regions
- North America, Global
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in Phonescams (TOAD)
Malware and tooling: BazarBackdoor, AnyDesk, Microsoft Quick Assist
How Phonescams (TOAD) works
Cofense Phishing Defense Center reports phone-based scam campaigns in which spoofed emails impersonating well-known brands claim unauthorized purchases or password resets and direct victims to call VoIP numbers, where live social engineering takes place. Campaigns use AI-generated polymorphic variations, fake invoices and urgency, and discourage email replies to force phone contact.
Cofense (Joseph Hoggle, published 2026-08-17) documents a family of 'phonescam' campaigns, a form of Telephone-Oriented Attack Delivery (TOAD) or callback phishing. Emails spoof or impersonate well-known brands and claim an unauthorized purchase, a completed purchase, a password reset or an account compromise. The brands observed are Microsoft, Target, Amazon, PayPal, Norton and Geek Squad, plus less common ones: Temu, Canva, GitHub and the Federal Trade Commission. The lure creates urgency ('Call Immediately') and discourages replying to the email, so the victim calls a provided free VoIP number and the scammer controls the conversation. Cofense states that adversaries need only free email addresses, text/photo editing tools and free VoIP numbers, and that AI lets low-skill actors distribute thousands of convincing emails with polymorphic variations that evade detection. Advanced variants use fake invoices (for example a Geek Squad invoice PDF) and, in one example, operational GitHub links that redirect to a fake invoice.
The Cofense article does not disclose phone numbers, sender domains, IPs or hashes, and it names no actor or malware. Corroborating public reporting describes the surrounding ecosystem. Barracuda (2026-08-28) reports sender infrastructure of unrelated .org domains, personal Gmail accounts, a compromised educational address used for Google Calendar invitations, lures with callback numbers hidden in images, misspelled brand text (P@YP@L), and dollar amounts such as $299.99, $518.93 and $599.99. IRONSCALES (2026-07-31) documents an Amazon fake order confirmation (iPhone 17, $975.00) sent from a consumer Gmail address through SendGrid, with SPF and DKIM passing for sendgrid.net and DMARC failing for gmail.com. Abnormal (2026-05-23) describes TOAD emails with phone numbers only and no link or attachment, traces the model to BazarCall (early 2021), and notes that groups such as Luna Moth (Silent Ransom Group) later dropped malware in favor of legitimate RMM tools; it also cites voice cloning, caller-ID spoofing, underground call centers and LLM-written lure text. Malwarebytes/Cisco Talos (2025-07-03) documents May-June 2025 callback phishing against Microsoft, NortonLifeLock, PayPal, DocuSign and Geek Squad using blank email bodies and PDFs that embed phone numbers, with lazy sender spoofing (letter-to-number swaps, added periods) and QR-code variants. IRONSCALES (2025-05-26) documents a Geek Squad JPEG invoice from a Hotmail address that passed SPF, DKIM, DMARC and ARC.
Because the emails carry no payload, URL or malware, gateway scanning has little to flag. Defenders should focus on behavioral email analysis (financial urgency plus a phone-only call to action, first-time sender, DMARC misalignment), OCR of image-only emails and PDFs, phone-number intelligence, endpoint detection of unsanctioned remote-access/RMM tools, and policies requiring callback verification through independent channels. Cofense itself recommends human-led analysis over secure email gateways. Indicators in the IOC list come from the corroborating reports where noted; the Cofense report discloses none, and none of the corroborating reports ties these campaigns to a single actor.
MITRE ATT&CK techniques used in TL-2026-3465
Execution
Command and Control
Initial Access
T1566 Phishing; T1566.001 Phishing: Spearphishing Attachment; T1566.004 Phishing: Spearphishing Voice
Resource Development
T1585.002 Establish Accounts: Email Accounts; T1588.007 Obtain Capabilities: Artificial Intelligence
Reconnaissance
T1598.004 Phishing for Information: Spearphishing Voice
Defense Evasion
Affected products and versions in Phonescams (TOAD)
- Multiple (brand impersonation) — Email users and organizations targeted with impersonated Microsoft, Amazon, Target, PayPal, Norton, Geek Squad, Temu, Canva, GitHub and FTC lures
Remediation for Phonescams (TOAD)
Immediate actions
- Report and quarantine emails that pair financial urgency (unauthorized purchase, password reset, invoice) with a phone number as the only call to action
- Block or flag known scam callback numbers and sender addresses in mail gateways and phone-number intelligence feeds
- Instruct users never to call numbers listed in unsolicited emails and to verify via the vendor's official site or app
- Flag mail relayed via bulk-mail services (e.g. SendGrid) where the From domain is a consumer mailbox provider and DMARC fails
Workarounds
- Restrict installation of remote access software via application control allowlisting
- Disable or restrict Windows Quick Assist for users who do not need it
Longer-term hardening
- Deploy email security with OCR/image analysis and behavioral detection for phone-only lures, including image-only emails and PDF attachments
- Alert on installation or execution of unsanctioned remote access/RMM tools on endpoints and correlate with recent suspicious email delivery
- Adopt FIDO2/phishing-resistant MFA to limit the impact of credential disclosure
- Run TOAD-specific awareness training and require callback verification through independent channels
Timeline of Phonescams (TOAD)
- Early 2021: BazarCall campaigns establish the callback phishing model (fake subscription emails, guided downloads, BazaLoader, Cobalt Strike, Ryuk), per Abnormal AI. Day is approximate; source says only 'early 2021'
- IRONSCALES publishes analysis of a Geek Squad TOAD invoice (JPEG attachment, Hotmail sender) that passed SPF/DKIM/DMARC/ARC and targeted an engineering manager
- Malwarebytes, citing Cisco Talos, reports May-June 2025 callback phishing impersonating Microsoft, NortonLifeLock, PayPal, DocuSign and Geek Squad with PDF-embedded support numbers
- Abnormal AI publishes TOAD analysis noting phone-number-only lures, the Luna Moth shift to legitimate RMM tools, and AI/voice-cloning/VoIP scaling of campaigns
- IRONSCALES documents an Amazon fake order confirmation (iPhone 17, $975.00) sent from a Gmail address via SendGrid with two scam callback numbers; SPF/DKIM pass for sendgrid.net while DMARC fails for gmail.com
- Cofense Phishing Defense Center publishes 'Phonescams' report on email-spoofed brand impersonation driving victims to scam VoIP numbers, with AI-generated polymorphic variants
- Barracuda publishes callback phishing playbook covering fake invoices, image-embedded phone numbers, Gmail/.org/edu sender infrastructure and Google Calendar invitation lures
Sources cited for Phonescams (TOAD)
- Phonescams: Casting a Wide Net in an Orchard of Low-Hanging Fruit (Cofense, Joseph Hoggle)
- Fake invoices, real scammers: The callback phishing playbook (Barracuda)
- TOAD Attacks: Why Phone-Oriented Phishing Evades Email Gateways (Abnormal AI)
- Microsoft, PayPal, DocuSign, and Geek Squad faked in callback phishing scams (Malwarebytes, citing Cisco Talos)
- No Links, No Malware, Just a Phone Number: Geek Squad TOAD Invoice Targets an Engineering Manager (IRONSCALES)
- Amazon fake order confirmation TOAD callback via SendGrid (IRONSCALES)
- PDFs: Portable documents or perfect deliveries for phish? (Cisco Talos)
- ET TOAD Rules Response Guidance (Emerging Threats community)
- MITRE ATT&CK T1566.004 Phishing: Spearphishing Voice
Detection coverage for TL-2026-3465
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3465 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.