Social engineering remains a central part of modern cyberattacks, according to a new report from CrowdStrike. Attackers are increasingly turning to voice phishing because it bypasses traditional security controls and leaves little forensic evidence, since the social engineering takes place over the phone.
“Voice phishing (vishing) has become a fast-moving identity-based initial access vector,” the researchers write. “CrowdStrike OverWatch detected a 2x increase in vishing intrusions in the first half of 2026 compared with the second half of 2025. Human-to-human interaction makes vishing especially compelling as a social engineering technique, enabling adversaries to impersonate IT staff and manipulate users into granting access. CORDIAL SPIDER and SNARKY SPIDER used vishing to compromise single sign-on (SSO) accounts and rapidly exfiltrate data from SaaS applications, with SNARKY SPIDER moving from account takeover to data theft in under five minutes. By compromising identities, these adversaries can rapidly access sensitive data without moving laterally or escalating privileges.”
These attacks also carry more of a sense of urgency, since the conversation is happening in real time.
“Direct human-to-human interaction enables a more compelling means of socially engineering targeted users than, for example, phishing emails,” the researchers write. “Threat actors often impersonate IT staff, citing the need to resolve a trivial support issue as a pretext for the call to manipulate targets into granting access.”
The researchers also observed a 15x increase in device code phishing attacks over the past six months.
“Device code phishing is an attack technique where adversaries abuse the OAuth 2.0 device authorization flow by tricking victims into entering attacker-controlled device codes on legitimate authentication portals, effectively granting the attacker access tokens to cloud services and applications,” CrowdStrike explains. “Unlike traditional phishing, it bypasses MFA since the victim authenticates legitimately; the attacker simply hijacks the resulting token.”
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 Platform to strengthen their security culture and reduce workforce risk.
CrowdStrike has the story: https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-threat-hunting-report/
