Google warns of vishing attacks targeting U.S. financial firms

Google Threat Intelligence Group said hackers were using voice phishing to reach employees inside large U.S. financial firms, then impersonating IT staff or other trusted insiders to win access to corporate systems and steal sensitive data.

In its June 4, 2025 report, The Cost of a Call: From Voice Phishing to Data Extortion, Google said the scheme fit a wider shift in cybercrime away from encryption-only ransomware and toward straight data extortion. By August 8, Google said it had completed email notifications to people affected by the incident, underscoring that the activity had crossed from intrusion into a breach serious enough to trigger direct victim notice.

The attack chain is built around trust. An employee receives a phone call, often from someone sounding like internal help desk staff, and is pushed to approve a login, share a one-time code or visit a credential-harvesting site branded to look like the victim company. Google’s later threat-intelligence work said ShinyHunters-branded operations used that mix of vishing and victim-branded credential-harvesting sites to steal single sign-on credentials, a shortcut that can open multiple cloud services at once. Once inside, attackers can pull data and threaten to leak it without ever encrypting a network.

That makes human targets the weak point. Financial firms spend heavily on perimeter defenses, endpoint tools and monitoring, but none of that helps if an employee hands over access to what sounds like an internal support desk. The stakes are especially high for banks, brokerages and other financial institutions because they hold client records, transaction histories and market-sensitive data. Even when systems stay online, extortion can trigger regulatory inquiries, reputational damage and operational disruption.

Google’s broader 2025 threat analysis showed how attractive that business model has become. Mandiant Consulting responded to almost four times more intrusions by financially motivated actors than by state-backed intrusions in 2024, a stark reminder that profit-driven crews continue to outpace many government-linked campaigns in volume.

The tactic has also spread beyond finance. Google’s threat work linked similar vishing methods to ShinyHunters activity against Salesforce customers, while the FBI’s Internet Crime Complaint Center warned on May 26, 2026 that Silent Ransom Group, also known as Luna Moth, Chatty Spider and UNC3753, was using phone calls, phishing emails and even in-person visits to pose as IT support. The message for financial institutions is immediate: train employees to challenge unsolicited calls, verify every help-desk request through a known internal channel, and treat voice as just another attack surface.