# Phonescams (TOAD): Email-Spoofed Brand Impersonation Driving Victims to Scam Phone Numbers

> Cofense Phishing Defense Center reports phone-based scam campaigns in which spoofed emails impersonating well-known brands claim unauthorized purchases or password resets and direct victims to call VoIP numbers, where live social engineering takes place. Campaigns use AI-generated polymorphic variations, fake invoices and urgency, and discourage email replies to force phone contact.

- **Published:** 2026-10-14T04:58:07Z
- **Last reviewed:** 2026-10-14T04:58:07Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3465
- **ID:** TL-2026-3465
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Cofense (Joseph Hoggle, published 2026-08-17) documents a family of 'phonescam' campaigns, a form of Telephone-Oriented Attack Delivery (TOAD) or callback phishing. Emails spoof or impersonate well-known brands and claim an unauthorized purchase, a completed purchase, a password reset or an account compromise. The brands observed are Microsoft, Target, Amazon, PayPal, Norton and Geek Squad, plus less common ones: Temu, Canva, GitHub and the Federal Trade Commission. The lure creates urgency ('Call Immediately') and discourages replying to the email, so the victim calls a provided free VoIP number and the scammer controls the conversation. Cofense states that adversaries need only free email addresses, text/photo editing tools and free VoIP numbers, and that AI lets low-skill actors distribute thousands of convincing emails with polymorphic variations that evade detection. Advanced variants use fake invoices (for example a Geek Squad invoice PDF) and, in one example, operational GitHub links that redirect to a fake invoice.

The Cofense article does not disclose phone numbers, sender domains, IPs or hashes, and it names no actor or malware. Corroborating public reporting describes the surrounding ecosystem. Barracuda (2026-08-28) reports sender infrastructure of unrelated .org domains, personal Gmail accounts, a compromised educational address used for Google Calendar invitations, lures with callback numbers hidden in images, misspelled brand text (P@YP@L), and dollar amounts such as $299.99, $518.93 and $599.99. IRONSCALES (2026-07-31) documents an Amazon fake order confirmation (iPhone 17, $975.00) sent from a consumer Gmail address through SendGrid, with SPF and DKIM passing for sendgrid.net and DMARC failing for gmail.com. Abnormal (2026-05-23) describes TOAD emails with phone numbers only and no link or attachment, traces the model to BazarCall (early 2021), and notes that groups such as Luna Moth (Silent Ransom Group) later dropped malware in favor of legitimate RMM tools; it also cites voice cloning, caller-ID spoofing, underground call centers and LLM-written lure text. Malwarebytes/Cisco Talos (2025-07-03) documents May-June 2025 callback phishing against Microsoft, NortonLifeLock, PayPal, DocuSign and Geek Squad using blank email bodies and PDFs that embed phone numbers, with lazy sender spoofing (letter-to-number swaps, added periods) and QR-code variants. IRONSCALES (2025-05-26) documents a Geek Squad JPEG invoice from a Hotmail address that passed SPF, DKIM, DMARC and ARC.

Because the emails carry no payload, URL or malware, gateway scanning has little to flag. Defenders should focus on behavioral email analysis (financial urgency plus a phone-only call to action, first-time sender, DMARC misalignment), OCR of image-only emails and PDFs, phone-number intelligence, endpoint detection of unsanctioned remote-access/RMM tools, and policies requiring callback verification through independent channels. Cofense itself recommends human-led analysis over secure email gateways. Indicators in the IOC list come from the corroborating reports where noted; the Cofense report discloses none, and none of the corroborating reports ties these campaigns to a single actor.

## MITRE ATT&CK

- T1566 Phishing
- T1566.001 Phishing: Spearphishing Attachment
- T1566.004 Phishing: Spearphishing Voice
- T1598.004 Phishing for Information: Spearphishing Voice
- T1684.001 Impersonation
- T1585.002 Establish Accounts: Email Accounts
- T1588.007 Obtain Capabilities: Artificial Intelligence
- T1204 User Execution
- T1219 Remote Access Tools

## Sources

- [Phonescams: Casting a Wide Net in an Orchard of Low-Hanging Fruit (Cofense, Joseph Hoggle)](https://cofense.com/blog/phonescams-casting-a-wide-net-in-an-orchard-of-low-hanging-fruit)
- [Fake invoices, real scammers: The callback phishing playbook (Barracuda)](https://blog.barracuda.com/2026/08/28/callback-phishing-fake-invoice-toad-attacks)
- [TOAD Attacks: Why Phone-Oriented Phishing Evades Email Gateways (Abnormal AI)](https://abnormal.ai/blog/toad-attacks-phone-phishing)
- [Microsoft, PayPal, DocuSign, and Geek Squad faked in callback phishing scams (Malwarebytes, citing Cisco Talos)](https://www.malwarebytes.com/blog/news/2025/07/microsoft-paypal-docusign-and-geek-squad-faked-in-callback-phishing-scams)
- [No Links, No Malware, Just a Phone Number: Geek Squad TOAD Invoice Targets an Engineering Manager (IRONSCALES)](https://ironscales.com/threat-intelligence/geek-squad-toad-callback-hotmail-jpeg-invoice-no-links)
- [Amazon fake order confirmation TOAD callback via SendGrid (IRONSCALES)](https://ironscales.com/threat-intelligence/amazon-fake-order-confirmation-toad-callback-sendgrid)
- [PDFs: Portable documents or perfect deliveries for phish? (Cisco Talos)](https://blog.talosintelligence.com/pdfs-portable-documents-or-perfect-deliveries-for-phish/)
- [ET TOAD Rules Response Guidance (Emerging Threats community)](https://community.emergingthreats.net/t/et-toad-rules-response-guidance/2663)
- [MITRE ATT&CK T1566.004 Phishing: Spearphishing Voice](https://attack.mitre.org/techniques/T1566/004/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3465