Help desk voice phishing: the AL26-028 alert

On October 28, 2026, the Canadian Centre for Cyber Security published alert AL26-028 on an ongoing voice phishing campaign targeting Canadian organizations. Callers impersonate internal IT support and direct employees to fraudulent sign-in pages. October activity was concentrated on the legal sector. The target is not a software flaw: it is the procedure that lets an employee, or the help desk itself, change an authentication factor over the phone.

What the sources say

Who is targeted. According to alert AL26-028, the campaign hits organizations including those in the legal and financial sectors. The Centre writes that the activity has been "increasingly targeting finance and legal organizations since July," with October activity concentrated on the legal sector. The French version reads: « Les activités recensées en octobre ciblaient principalement le secteur juridique et judiciaire. »

The pretext. "Callers impersonate internal IT or help desk staff" and claim an urgent passkey migration, MFA enrolment or password change. The employee is then sent to a fake sign-in page. The Centre says the campaign bypasses conventional multi-factor authentication and that the domains used change often, which limits the value of blocklists.

After access. The alert adds that the attackers register their own MFA methods on the account, delete security notifications, exfiltrate data from Microsoft 365 and connected cloud applications, and sometimes demand extortion payments.

What the Centre recommends. "Deploy phishing-resistant MFA, such as FIDO2 security keys, device-bound passkeys or platform authenticators," "particularly for privileged and high-risk users." Use conditional access to require managed devices and restrict sign-ins from commercial VPNs, hosting providers and residential proxies. "Strengthen verification for MFA resets, account recovery and new device enrolments, and reduce session lifetimes." "Instruct employees to independently verify unexpected IT calls requesting MFA, passkey or password changes," and give them a clear channel to report a suspicious call or site. Restrict external communications in collaboration platforms and review guest access regularly.

Why it matters

A help desk is built to unblock people fast. An employee locked out of their account must get back in the same day, and that goodwill is exactly what the campaign exploits, in both directions: the employee trusts a voice that says it is IT, and IT trusts a voice that says it is an employee.

The legal sector lends itself to extortion. A firm holds client files, confidential documents and sensitive correspondence, often gathered in a single cloud suite. One compromised account opens a mailbox and files whose disclosure would be costly, and the alert does mention extortion demands. And when support is outsourced to a provider, employees are used to talking to technicians they do not know.

Finally, the alert confirms what we wrote about phishing-resistant MFA: a code to type or a notification to approve does not protect against a person who convinces the employee to do it themselves. Only a factor bound to the domain and the device cuts off this scenario.

What we think at Sentrix

1. Write down the help desk verification procedure. No password or MFA reset on the strength of a call alone: a callback to the number in the directory, confirmation by the manager, or in-person or video verification for sensitive accounts. The procedure is drafted, approved and reviewed like a policy, which our policy management module supports.
2. Start with privileged accounts. Administrators, partners, finance and the help desk itself move to FIDO2 keys or passkeys first, as our article on rolling out passkeys describes.
3. Treat a new MFA method as an event to watch. A new method, a new device or deleted security emails trigger an alert and a check, not just a log line. Our identity and access service covers conditional access and these alerts.
4. Make the right reflex easy. Tell employees plainly that IT will never ask them to change a factor over the phone, and give them one place to report a doubtful call. The Canadian fraud data in phishing and fraud: the Canadian numbers shows why awareness must include the phone.
5. Prepare the response before the call. Revoking sessions, removing unauthorised MFA methods, preserving logs: these steps are rehearsed in a tabletop exercise so they take minutes on the day.
6. Hold outsourced support to the same standard. If a provider runs your help desk, its verification procedure is part of your risk. Ask for it and document it in your third-party risk assessment.

The next step

Call your own help desk this week posing as an employee who lost their phone, and note what it takes to get a reset. If the answer fits in one sentence, the procedure needs rewriting. If you want to do this exercise with us, contact us.