<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-voice-phishing-attacks
description: >-
  Detect and defend against voice phishing (vishing) attacks including
  caller ID spoofing, AI-generated voice deepfakes, pretexting calls,
  and hybrid email-to-phone social engineering campaigns.
domain: cybersecurity
subdomain: phishing-defense
tags:
  - vishing
  - voice-phishing
  - caller-id-spoofing
  - social-engineering
  - ai-voice-clone
  - deepfake-audio
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566.004"]
---

# Detecting Voice Phishing Attacks

## Overview

Voice phishing (vishing) uses phone calls to socially engineer targets into
revealing credentials, authorizing transactions, or installing malware. Modern
vishing includes AI-generated voice deepfakes, caller ID spoofing, and hybrid
campaigns combining email and phone.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | Agent tooling runtime |
| Call metadata logs | PBX/VoIP CDR (Call Detail Records) |
| `librosa` | `pip install librosa` — audio analysis (optional) |
| STIR/SHAKEN data | Caller ID attestation info |

## Key Concepts

### Vishing Attack Types

| Type | Description | Example |
|---|---|---|
| IT Support Scam | Impersonates helpdesk | "Account locked, provide password" |
| Executive Impersonation | AI voice clone | "Authorize wire transfer" |
| Bank Fraud | Fake fraud department | "Suspicious activity detected" |
| Hybrid TOAD | Email + callback | "Call to cancel subscription" |

### Detection Layers

```
Layer 1 — Telephony    : STIR/SHAKEN attestation, caller ID verification
Layer 2 — CDR Analysis : Call pattern anomalies, spoofed number detection
Layer 3 — Audio        : AI voice detection, background noise analysis
Layer 4 — User Report  : Vishing report intake and correlation
```

### MITRE ATT&CK Mapping

| Technique | ID | Description |
|---|---|---|
| Phishing: Spearphishing Voice | T1566.004 | Voice social engineering |

## Workflow

### 1. Analyze Call Metadata

```bash
node agent.js analyze-cdr --cdr-file /tmp/call_records.csv
node agent.js detect-spoofing --cdr-file /tmp/call_records.csv
node agent.js check-numbers --cdr-file /tmp/call_records.csv \
  --blocklist /tmp/known_vishing.txt
```

### 2. Voice Deepfake Detection

```bash
node agent.js analyze-audio --audio-file /tmp/suspicious_call.wav
node agent.js deepfake-checklist
```

### 3. User Reporting and Hardening

```bash
node agent.js process-report --reporter user@company.com \
  --caller-number "+18005551234" --pretext "IT support"
node agent.js generate-advisory --attack-type executive-impersonation
node agent.js audit-telephony --provider voip
node agent.js stirshaken-report
```

## Detection

```yaml
title: Voice Phishing Attacks Detection
id: fee82d4f-479c-4842-9e7f-355298cf19a2
status: experimental
description: Detects suspicious activity related to detecting voice phishing attacks techniques in phishing defense context
logsource:
  category: email
  service: o365
detection:
  selection:
    Subject: "*urgent*"
  condition: selection
level: high
tags:
  - attack.t1566.004
  - attack.initial_access
falsepositives:
  - Security awareness training platform sending simulated phishing emails
```

## Verification

| Check | Method |
|---|---|
| CDR analysis complete | Patterns identified |
| Spoofed calls flagged | Non-attested calls detected |
| Audio analyzed | Deepfake indicators assessed |
| Reports processed | User reports triaged |

## References

- [MITRE ATT&CK T1566.004](https://attack.mitre.org/techniques/T1566/004/)
- [FCC STIR/SHAKEN](https://www.fcc.gov/call-authentication)
- [FBI Vishing Advisory](https://www.ic3.gov/Media/Y2020/PSA200813)
