By @malearnity
Publication Date: 2026-05-06 10:00:00
- Cisco Talos has recently started to collect and gather intelligence around phone numbers within emails as an additional indicator of compromise (IOC). In this blog, we discuss new insights into in-the-wild phone number reuse in scam emails.
- According to Talos’ observations, the ease of API-driven provisioning makes a few VoIP providers the preferred tool for attackers, allowing for high-volume, cost-effective scam operations that are difficult to trace.
- Attackers maintain operational continuity by rotating through sequential blocks of phone numbers and utilizing strategic cool-down periods, with a median phone number lifespan of 14 days, to effectively evade reputation-based security filters.
- Threat actors try to maximize their reach by recycling the same phone numbers across diverse, seemingly unrelated lures – including varied subject lines and different attachment formats like HEIC and PDF – to impersonate multiple brands…
