posts
A Single Phone Call Cost MGM Resorts $100 Million In September 2023, a threat actor called MGM Resorts' IT help desk, impersonated an employee found on LinkedIn, and convinced a technician to reset credentials. That one vishing call triggered a ransomware attack that shut down slot machines, hotel key
A Single Phone Call Cost One Company $25 Million In early 2024, a finance worker at engineering firm Arup was tricked into wiring $25 million after a video call with what appeared to be the company's CFO — deepfake technology made the voice and face indistinguishable from the real
In 2023, the FBI's Internet Crime Complaint Center (IC3) received over 298,000 complaints related to phishing and its variants — including vishing — resulting in losses exceeding $18.7 billion across all reported cybercrime categories. Voice phishing, or vishing, is one of the fastest-growing attack vectors because it bypasses
In March 2025, the FBI's Internet Crime Complaint Center reported that Americans lost over $12.5 billion to cybercrime in 2023 alone — and voice-based social engineering was one of the fastest-growing attack vectors. I've personally investigated cases where a single phone call cost an organization six
The Phone Call That Cost One Company $25 Million In early 2024, a finance worker at engineering firm Arup was tricked into transferring $25 million after receiving a video call that appeared to include the company's CFO and other colleagues — all deepfake recreations. The attack started with a
In July 2020, a teenager and two accomplices called Twitter employees, posed as IT staff, and convinced them to hand over internal credentials. Within hours, they'd hijacked 130 high-profile accounts — including Barack Obama, Elon Musk, and Apple — and ran a Bitcoin scam that netted over $100,000 in
In January 2021, the FBI and CISA issued a joint advisory warning about a surge in vishing attacks targeting corporate employees working from home. Threat actors were calling employees directly, impersonating IT help desks, and convincing them to hand over VPN credentials. Within hours, attackers had access to internal networks,
