Callback Phishing: The Attack That Asks You to Call Them

Callback phishing — also called telephone-oriented attack delivery (TOAD) — inverts the usual phishing flow. The initial email contains no malicious link or attachment, only a plausible pretext (a subscription renewal, an invoice, a fraud alert) and a phone number to “dispute the charge.” Because there is nothing for a scanner to detonate, the message often lands in the inbox. When the victim calls, a human operator in a fake call centre walks them into installing remote-access software or disclosing credentials. The technique was popularised by the BazarCall (BazaCall) campaigns tied to Ryuk/Conti and is central to Luna Moth (Silent Ransom Group) data-extortion operations.

How It Works

The lure email reports a pending charge or expiring subscription and urges the recipient to call a number to cancel. The call reaches an attacker-run “support” agent who, under the guise of helping, directs the victim to a site to download legitimate remote-access or remote-support software (for example AnyDesk, Zoho Assist or similar). Once connected, the operator deploys further tooling, steals data (often with legitimate utilities such as Rclone or WinSCP), or stages ransomware. T1566 T1566.004 T1219 T1204

Notable Use

• BazarCall / BazaCall (from 2021): call-centre lures that delivered the BazarLoader backdoor, feeding Ryuk and Conti ransomware operations.
• Luna Moth / Silent Ransom Group (2022 onward): callback-led data-theft extortion that leans on legitimate remote-support tools rather than custom malware, making it hard to detect by signature.

MITRE ATT&CK Mapping

Detection & Mitigation

• Application-control and alert on unsanctioned remote-access/remote-support software (AnyDesk, Zoho Assist, ScreenConnect, TeamViewer and similar) on endpoints, and block its installation by standard users.
• Tune mail security for TOAD patterns — invoice/subscription themes whose only action is a phone number — even though they carry no link or attachment.
• Train staff that legitimate vendors do not ask them to install remote-control software to cancel a charge; give users an easy way to verify and report such emails.