The cybercrime alliance Scattered LAPSUS$ Hunters (SLH) is reportedly offering $500 to $1,000 upfront per call to recruit women for targeted voice phishing (vishing) operations.

This tactical shift leverages the psychological bias that female voices may be perceived as more “trustworthy” or less threatening by IT help desk staff during social engineering attempts.

Campaign Breakdown

• Targeting: The group aims to compromise corporate environments—specifically Okta, Microsoft Azure, and Salesforce—by tricking support staff into resetting passwords or bypasses MFA.
• The “Kit”: Recruits are provided with pre-written scripts and detailed employee dossiers to make their impersonation attempts more convincing.
• The Alliance: SLH is a high-profile “supergroup” consisting of members from Scattered Spider, LAPSUS$, and ShinyHunters, known for their sophisticated social engineering tactics.
• Rising Threat: This recruitment drive coincides with a massive 442% increase in vishing attacks, as noted in threat intelligence reports by Dataminr.

Defense Against Vishing

To counter these human-led attacks, security experts at CISA recommend that organizations implement “out-of-band” verification (calling the employee back on a registered number) and transition to FIDO2-compliant hardware security keys to neutralize MFA fatigue.