AI-Powered Phishing Kits Enable Coordinated Vishing Attacks
Threat actors are deploying AI-powered phishing kits that combine voice cloning with fake login pages to conduct coordinated vishing attacks against major platforms. According to Okta's threat intelligence analysis, these kits sold on underground markets synchronize deceptive phone calls with digital interfaces to steal credentials and multi-factor authentication approvals.
What happened
Cyber attackers are using advanced phishing kits incorporating AI voice cloning technology to conduct vishing scams, synchronizing deceptive phone calls with fake online interfaces. These kits intercept login credentials and provide attackers with real-time data to manipulate victims over the phone.
The kits are sold as a service on underground markets and have been used against platforms including Google, Microsoft, and cryptocurrency providers. Attackers can adjust phishing pages on the fly to match the victim's browser experience with the ongoing phone conversation, including prompting for multi-factor authentication (MFA) approvals.
Reported impact
Vishing attacks coordinated through these kits are designed to steal credentials, MFA approvals, corporate account access, and cryptocurrency wallet information. The synchronization between voice calls and fake digital interfaces makes it harder for victims to identify fraud.
Index analysis
Okta's threat intelligence team documented these tools being used to target major platforms and noted the trend accelerated since late 2025. The kits provide live feedback to attackers, allowing them to adjust their pitch based on victim hesitation and other real-time indicators.
Governance controls
Defenses recommended include improved multi-factor authentication mechanisms and enhanced employee training to recognize coordinated vishing and phishing attacks.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.