In a world of high-tech firewalls and AI-driven threat detection, the most dangerous vulnerability remains the one that answers the phone.
This week, the fintech world was rocked by news that Figure Technology Solutions suffered a significant data breach, with the notorious ShinyHunters group claiming to have leaked over 2.4GB of data—including nearly 1 million user records.
The most unsettling part? This wasn’t a complex code exploit or a server-side back door. It started with a phone call.
The Anatomy of the Attack - What is "Vishing"?
The Figure breach is reportedly part of a wider campaign targeting Single Sign-On (SSO) providers like Okta and Entra ID. The attackers used a technique known as Voice Phishing, or "Vishing."
Here is how the 2026 version of this scam works,
- The Hook - A hacker calls an employee, often spoofing the number of the company’s internal IT helpdesk or a known security vendor.
- The Persuasion - Using AI-enhanced voice cloning or highly researched social engineering, they convince the employee that there is an urgent security issue with their account.
- The Payload - The employee is "guided" to a fake login page or asked to read back an MFA (Multi-Factor Authentication) code. Once the hacker has that code, they bypass the SSO and gain the keys to the entire corporate kingdom.
Why SSO is the New High-Ground
As we move toward unified identity management, our SSO accounts have become the "Golden Key." If an attacker compromises your Okta or Microsoft login via vishing, they don't just have your email—they have your CRM, your cloud storage, and your financial tools.
The Figure breach reminds us that MFA is not a silver bullet if your users can be talked into handing over the codes.
How NOCTeam Protects Your Identity
At NOCTeam, we believe that security is a combination of hardened tech and informed people. We’ve already moved our clients beyond "Basic MFA" to combat these exact scenarios.
How we help secure your "Human Firewall"
- Phishing-Resistant MFA - We deploy hardware keys (like YubiKeys) or certificate-based authentication that cannot be "read back" over the phone to a scammer.
- Vishing Simulation & Training - We run controlled, educational simulations to teach your team how to spot a fraudulent helpdesk call before they disclose sensitive data.
- SSO Hardening - We implement "Conditional Access" policies that look at more than just a password—analysing location, device health, and login patterns to block suspicious activity in real-time.
- 24/7 EDR Monitoring - If an account is compromised, our Endpoint Detection and Response tools catch the lateral movement immediately, isolating the threat before data can be exfiltrated.
Is your team ready for the "Helpdesk" call that isn't real?
Don't let your identity be the next headline on a leak site. Reach out to NOCTeam today for a comprehensive Identity & Access audit.
Contact us at [email protected]
Originally published on LinkedIn.