What Canada Warned About
In alert AL26-028 dated October 28, 2026, the Canadian Centre for Cyber Security described an ongoing voice-phishing campaign affecting Canadian organisations. The agency said multiple firms, including legal and financial businesses, had been targeted by people pretending to be internal IT support. The callers create a sense of urgency about passkey migrations, multifactor authentication enrolment or password changes and direct employees to convincing but fraudulent sign-in pages.
How A Session Can Be Stolen
According to the alert, an attacker-controlled sign-in site can operate as an adversary-in-the-middle relay. An employee may enter credentials and complete an authentication step while believing they are interacting with a legitimate portal. The attacker can then obtain an authenticated session despite ordinary multifactor authentication being enabled. The agency also describes telephone-number spoofing and fast-changing website domains, which make simple caller-ID and blocklist checks unreliable.
What Happens After Access
The Canadian notice describes attempts to register additional authentication methods, tamper with security notifications, and access Microsoft 365 or connected SaaS data using automated tooling. Reported activity can include theft of documents and extortion. These are techniques associated with the campaign; the alert does not say that every targeted organisation suffered a successful compromise.
Practical Response For Organisations
Train employees to end unexpected IT calls and initiate a callback through a known internal support channel. Use phishing-resistant authentication such as device-bound passkeys or FIDO2 security keys for sensitive accounts; require managed devices for high-risk access where feasible. Add heightened verification for MFA resets, new devices and account recovery. Monitor unusual authentication-method registrations, bulk cloud-file access and suspicious deletion of security emails.
If A Compromise Is Suspected
Revoke sessions and access tokens, reset credentials, remove unauthorised MFA methods, and preserve identity-provider and cloud-service audit logs. Review relevant mailbox and file activity. Report the incident through the organisation's response process and consult the full Canadian advisory for detailed detection and recovery guidance.