<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-callback-phishing
description: >-
  Detect and respond to callback phishing (TOAD) attacks where emails contain
  phone numbers instead of links, instructing victims to call attacker-controlled
  call centers for social engineering, remote access tool installation, or
  credential harvesting.
domain: cybersecurity
subdomain: phishing-defense
tags:
  - callback-phishing
  - toad
  - telephone-oriented-attack
  - social-engineering
  - vishing-hybrid
  - remote-access
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566"]
---

# Detecting Callback Phishing

## Overview

Callback phishing (Telephone-Oriented Attack Delivery — TOAD) bypasses
traditional email security by replacing malicious links with phone numbers.
Victims call attacker-controlled numbers and are socially engineered into
installing remote access tools (AnyDesk, TeamViewer), providing credentials,
or executing malicious commands. This skill covers detection via content
analysis, phone number extraction, pattern matching, and response procedures.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | Agent tooling runtime |
| `phonenumbers` | `pip install phonenumbers` — phone number parsing |
| SIEM access | Splunk / Elastic / Sentinel for correlation |
| EDR access | Monitor for RAT installations post-call |
| `jq` | JSON processing |

## Key Concepts

### Callback Phishing Kill Chain

```
Step 1 — Delivery      : Email with fake invoice/subscription/charge
Step 2 — Pretext       : "Call this number to cancel/dispute"
Step 3 — Social Eng    : Victim calls, attacker impersonates support
Step 4 — Tool Install  : Attacker guides victim to install RAT
Step 5 — Access        : Attacker gains remote control via RAT
Step 6 — Objective     : Data theft, ransomware deployment, persistence
```

### Detection Indicators

| Indicator | Weight | Description |
|---|---|---|
| Phone number in body, no URLs | Critical | Hallmark of callback phishing |
| Fake subscription notice | High | Netflix, PayPal, Geek Squad pretexts |
| Urgency + financial threat | High | "You will be charged $499.99" |
| No sender history | Medium | First-time sender to recipient |
| PDF/image attachment with number | Medium | Phone number embedded in image |
| Toll-free or VoIP number | Medium | Attacker-provisioned numbers |

### MITRE ATT&CK Mapping

| Technique | ID | Description |
|---|---|---|
| Phishing: Spearphishing Voice | T1566.004 | Voice phishing via callback |
| User Execution: Malicious File | T1204.002 | RAT installation after call |
| Remote Access Software | T1219 | AnyDesk, TeamViewer abuse |

## Workflow

### 1. Detect Callback Phishing Emails

```bash
# Scan email for callback phishing indicators
node agent.js detect --email /tmp/suspect_email.eml

# Extract phone numbers from email body
node agent.js extract-numbers --email /tmp/suspect_email.eml

# Batch scan inbox export for callback patterns
node agent.js batch-scan --mailbox-export /tmp/inbox_export/ \
  --output /tmp/callback_results.json
```

### 2. Phone Number Analysis

```bash
# Validate and classify extracted phone numbers
node agent.js analyze-number --number "+18005551234"

# Check number against known TOAD campaign databases
node agent.js check-number --number "+18005551234" \
  --database /tmp/known_toad_numbers.txt
```

### 3. Post-Callback Detection (EDR)

```bash
# Generate EDR query for RAT installations following callback
node agent.js generate-edr-query --tool anydesk

# Sigma rule for callback phishing RAT installation
node agent.js generate-sigma --detection-type rat-install
```

### 4. Response Actions

```bash
# Generate incident report for callback phishing
node agent.js incident-report --email /tmp/suspect.eml \
  --numbers "+18005551234" --affected-users user@company.com

# Block phone numbers in telephony system
node agent.js block-numbers --number-file /tmp/toad_numbers.txt
```

## Detection

```yaml
title: Callback Phishing Detection
id: 8724152d-ccce-4536-bbcc-8bfd4c8bed40
status: experimental
description: Detects suspicious activity related to detecting callback phishing techniques in phishing defense context
logsource:
  category: email
  service: o365
detection:
  selection:
    Subject: "*urgent*"
  condition: selection
level: high
tags:
  - attack.t1566
  - attack.initial_access
falsepositives:
  - Security awareness training platform sending simulated phishing emails
```

## Verification

| Check | Method |
|---|---|
| Callback pattern detected | Email flagged with phone number, no URLs |
| Phone numbers extracted | All numbers parsed with country codes |
| Number type classified | Toll-free, VoIP, mobile identified |
| EDR query generated | RAT installation detection query produced |
| Sigma rule valid | Detection rule passes validation |
| Incident report generated | Structured report with IOCs |

## References

- [MITRE ATT&CK T1566.004 — Phishing via Voice](https://attack.mitre.org/techniques/T1566/004/)
- [Proofpoint TOAD Research](https://www.proofpoint.com/us/blog/threat-insight/caught-beneath-landline-411-telephone-oriented-attack-delivery)
- [CrowdStrike Callback Phishing Analysis](https://www.crowdstrike.com/blog/callback-phishing-campaigns/)
- [Abnormal Security TOAD Detection](https://abnormalsecurity.com/glossary/callback-phishing)
