The most effective attack of the last month used no exploit, no malware, and no vulnerability. Levi Strauss disclosed on an SEC Form 8-K that attackers compromised three employee laptops and exfiltrated corporate data purely through social engineering — no ransomware, no ransom demand, nobody even claiming it. Around the same time, ShinyHunters dumped 280GB of RingCentral data after a “sophisticated social engineering campaign,” exposing 1.6 million contacts with names, phone numbers, and addresses — a ready-made call list for the next round of voice phishing.

This is the uncomfortable truth every technical control eventually runs into: the human is the API with no authentication. You can patch every server and still get owned because someone helpful answered the phone. The good news is that social engineering has a repeatable structure, and once you can see the structure, you can break it. This one’s less about code and more about habits — the same OPSEC mindset that protects everything else.

The Anatomy of a Vishing Attack

“Vishing” is voice phishing — social engineering over a phone call. The Scattered Spider crews that hit major companies (and landed several members in prison this year) ran a script so consistent you can memorize it:

  1. Recon. They learn your org chart, your vendors, your lingo — often from LinkedIn, past breaches, or a dump like the RingCentral one. They’ll know your manager’s name and your ticketing system.
  2. Pretext. They call the help desk as you (“Hi, this is Jordan in Sales, I’m locked out and I’ve got a client call in five minutes”), or they call you posing as IT/help desk.
  3. Urgency + authority. There’s always a deadline and always someone important. Urgency shuts off the part of your brain that verifies. This is the whole game.
  4. The ask. Reset my MFA. Read me the code. Approve this push notification. Install this “support tool.” Each one sounds reasonable in isolation.
  5. Pivot. One reset becomes access, access becomes lateral movement, and three laptops later it’s an 8-K filing.

Notice there’s no hacking in that list. Every step is a conversation.

Why It Beats Your Technical Defenses

  • It targets the reset path, not the login. You can have a great password and MFA, and the attacker simply calls the help desk to reset your MFA to their device. The front door is locked; they’re social-engineering a new key.
  • It uses your helpfulness against you. Support staff are trained and rewarded to be fast and accommodating. Attackers weaponize exactly that.
  • It’s cheap and repeatable. No zero-day to burn. Just a phone and a script — and now, AI voice cloning to sound like a specific colleague.

Defense 1: A Verification Protocol (The Core Fix)

The single most powerful defense is a rule with no exceptions: identity is verified through a channel the caller doesn’t control. Whether you’re the one being called or you run a help desk:

  • Call back on a known-good number. Someone from “IT” calls asking you to do something sensitive? Hang up and call the official IT number from your directory — not a number they gave you. Legitimate IT will never mind.
  • Verify out-of-band. A “coworker” messages urgently asking for access or a code? Confirm through a different channel — a separate app, a face-to-face, the number you already had.
  • Use a challenge that isn’t public. For help desks: verify identity with something an attacker can’t scrape (a manager confirmation, an in-person check, a pre-shared code), never with info from a data broker like “date of birth” or “last four.”
  • Slow down on purpose. Urgency is the tell. A real emergency survives a five-minute verification. “There’s no time to verify” is the attack, spoken aloud.

Write it down, make it a policy, and give people explicit permission to say “I need to verify first” to anyone, no matter how senior they claim to be. Removing the social cost of pausing is half the battle.

Defense 2: Phish-Resistant MFA

Social engineering often ends in “read me the code” or “approve the push.” Take those away:

  • Use passkeys / FIDO2 hardware keys for your important accounts. A physical security key is bound to the real site and can’t be read aloud, relayed, or approved by mistake — there’s no code to phish. We walked through enrollment in Stop Credential Stuffing Cold.
  • Kill SMS and “approve this push” where you can. Push-approval fatigue (spamming you with prompts until you tap “yes”) and SMS relay are exactly what vishers exploit. Number-matching or a hardware key defeats both.
  • Lock down the reset path. The reset process should be harder to social-engineer than the login, not easier. If resetting MFA just takes a phone call, your MFA is theater.

Defense 3: Shrink What Attackers Can Learn

Vishing runs on recon. The RingCentral dump exists to fuel it. Reduce your exposure:

  • Assume your phone number and email are already on a list (they probably are — check the breach data). Treat unsolicited calls and texts as untrusted by default.
  • Trim your public footprint. The less an attacker can learn about your role, tools, and colleagues from LinkedIn and social media, the weaker their pretext. Classic anonymity-and-OPSEC hygiene applies.
  • Be suspicious of specificity. “I know your manager is Sam and you use Okta” is meant to build trust. Correct details prove they did recon, not that they’re legitimate.

Defense 4: Train the Human Firewall

Technology can’t fully fix a people problem — practice can. This is where you’d normally see a note about running phishing simulations; the same principles from our phishing tutorial apply to voice:

  • Run drills. Simulate a vishing call. The goal isn’t to shame anyone — it’s to make “verify first” a reflex under pressure.
  • Make reporting easy and blameless. Someone who almost fell for it and reports it is your best early-warning sensor. Punishing near-misses guarantees the next one stays hidden.
  • Rehearse the script out loud: “I’m going to verify this and call you back on our official number.” Having the words ready makes it easy to say to a pushy “executive.”

Your Anti-Social-Engineering Checklist

  • Adopt a hard rule: sensitive requests are verified via a channel the caller doesn’t control.
  • Move important accounts to passkeys / FIDO2 keys — no codes to read aloud.
  • Make your MFA reset path harder than login, not a simple phone call.
  • Assume your contact details are leaked; treat unsolicited contact as untrusted.
  • Trim public info about your role, tools, and colleagues.
  • Run a vishing drill and make near-miss reporting blameless.

The Bottom Line

Levi Strauss got three laptops taken without a single exploit, and the RingCentral leak just handed the next crew 1.6 million people to call. Social engineering is the attack that walks around every firewall you own, because it targets the one component you can’t patch. But it has a fixed script — recon, pretext, urgency, ask — and each step has a counter. Verify out of band, use MFA that can’t be read aloud, starve the recon, and rehearse the pause. The attackers are counting on you being helpful and fast. Being deliberate is the whole defense.

The full Levi Strauss and RingCentral write-ups are on our sister site: Three Laptops, No Exploit and RingCentral Refused to Pay.