Accorian would like to alert you to an ongoing voice-phishing (vishing) campaign targeting organizations through fraudulent IT support calls and Microsoft Teams communications.
Recent reports indicate that at least four prominent Canadian law firms, including McCarthy Tétrault, Davies Ward Phillips & Vineberg, Bennett Jones, and Borden Ladner Gervais, were compromised in attacks involving the impersonation of internal IT personnel. The incidents resulted in unauthorized access to sensitive corporate and client information.
On October 28, 2026, the Canadian Centre for Cyber Security issued an official alert (AL26-028) warning that attackers are using sophisticated social engineering techniques to bypass conventional multi-factor authentication (MFA).
How the Attack Works
Attackers are exploiting employees’ trust in internal IT support through the following techniques:
- IT Help Desk Impersonation: Attackers contact employees through Microsoft Teams or phone calls, posing as internal IT personnel and claiming that urgent password resets, software updates, or MFA changes are required.
- Fraudulent Login Pages: Employees are directed to organization-branded phishing websites designed to resemble legitimate authentication portals.
- MFA Bypass: Attackers use adversary-in-the-middle (AiTM) techniques to relay login credentials and MFA responses in real time, obtaining authenticated sessions.
- Unauthorized Data Access: Following successful compromise, attackers may register additional MFA methods, access Microsoft 365 environments, and extract sensitive information from SharePoint, OneDrive, and connected applications.
- Data Theft and Extortion: Stolen information may be used for extortion or further targeted attacks.
Potential Business Impact
This campaign presents significant risks to organizations relying on cloud collaboration platforms and conventional MFA, including:
- Unauthorized access to confidential business and client information.
- Compromise of Microsoft 365 accounts and cloud-stored documents.
- Exposure of sensitive financial, legal, and personal records.
- Business disruption, regulatory exposure, and reputational damage.
Although the recently reported breaches involved Canadian law firms, the underlying attack techniques are applicable across industries.
Recommended Security Actions
Accorian strongly recommends that organizations take the following precautionary measures:
- Verify IT Support Requests: Instruct employees to independently verify unexpected password-reset, MFA enrollment, or software-update requests through approved internal channels.
- Implement Phishing-Resistant MFA: Prioritize FIDO2 security keys, device-bound passkeys, or equivalent phishing-resistant authentication methods.
- Monitor Authentication Activity: Review unusual sign-ins, unauthorized MFA registrations, suspicious session activity, and changes to account recovery settings.
- Strengthen Microsoft 365 Security: Monitor abnormal SharePoint and OneDrive downloads, Microsoft Graph activity, and suspicious mailbox changes.
- Restrict External Collaboration: Review Microsoft Teams external communication settings and limit access to trusted contacts where operationally feasible.
- Prepare for Incident Response: If compromise is suspected, revoke active sessions, reset affected credentials, remove unauthorized MFA methods, and preserve relevant audit logs.
How Accorian Can Help
Accorian can support your organization in assessing exposure to these attack techniques through identity and access security assessments, Microsoft 365 security reviews, penetration testing, and incident response readiness assessments.
Our cybersecurity experts can help identify weaknesses in authentication controls, cloud configurations, and employee-facing security processes before they are exploited.
If you suspect suspicious activity or would like assistance evaluating your organization’s exposure, please contact your Accorian representative or schedule a call directly with one of our security experts.
References:
- Canadian Centre for Cyber Security: Alert AL26-028
- The Globe and Mail: How hackers broke into four of Canada’s top law firms
