AISEC > Security News > SLH Recruiting Women for IT Help Desk Vishing Attacks
February 25, 2026 #attack Source: The Hacker News 3 min read · 622 words

SLH Offers $500–$1,000 Per Call to Recruit Women for IT Help Desk Vishing Attacks

SLH пропонує $500–$1,000 за дзвінок для залучення жінок до vishing-атак на IT-гарячі лінії

There's a new angle on an old threat, and it's worth paying attention. According to The Hacker News, the Scattered LAPSUS$ Hunters (SLH) cybercrime group is actively recruiting women to conduct vishing attacks—that's voice phishing—against organizational IT help desks, offering compensation of $500 to $1,000 per successful call. This isn't some hypothetical risk buried in a threat report. It's happening now, and it's a deliberate exploitation of social engineering vulnerabilities that most organizations still haven't adequately defended against.

Before we dig into the specifics, let's be clear about what this signals: attackers have identified a gap in human-centric security defenses and they're operationalizing it at scale. They're not just exploiting technology anymore. They're weaponizing assumptions about gender, trust, and authority that people carry into every phone call.

What We Know

SLH is running a recruitment campaign. They're posting job listings—basically—in underground forums and dark web marketplaces offering substantial payouts for each successful vishing call. The targeting of women specifically suggests they've done their homework: help desk staff tend to lower their guard more readily when speaking with callers perceived as non-threatening, and gender-based social engineering exploits that bias ruthlessly.

The timeline matters here. This isn't a sudden development. Vishing has been a proven attack vector for years, but the systematic recruitment and industrialization of it? That's escalation.

And then it got worse.

The financial incentive structure is designed to be attractive without being suspicious. Five hundred to a thousand dollars per call creates a scalable workforce of motivated attackers who don't need deep technical knowledge—just social engineering skills and a convincing narrative.

How It Works

A recruited caller phones your help desk claiming to be an employee, contractor, or vendor with an urgent access problem. They've usually been prepped with enough surface-level details to sound legitimate: department names, system names, maybe a stolen employee ID they've researched. The goal is straightforward: trick the help desk into resetting credentials, providing access codes, or revealing authentication mechanisms.

What makes this dangerous is the cognitive load on your help desk staff. They're trained to be helpful. They're answering dozens of calls daily. They're tired. And now there's a seemingly credible person on the line with a problem that sounds real.

The caller doesn't need to get everything right. They just need to get one thing right—one tech, one day, one moment of inattention—and they've breached your perimeter without touching a firewall.

Why It Matters

IT help desks are the soft underbelly of most organizations' security posture. They have legitimate access to password reset systems, MFA bypass procedures, and employee databases. They're also staffed by humans who are taught to prioritize customer service and helping colleagues.

So why does this matter right now? Because attackers have figured out how to scale vishing attacks by outsourcing them to a motivated, distributed workforce. They've removed the technical barrier to entry. Now anyone with decent social skills can be a threat actor. The recruitment itself signals that SLH views this as a profitable, sustainable operation—not a one-off campaign.

This is particularly nasty because it works.

Next Steps

First: implement verification protocols that don't rely on caller politeness or perceived trustworthiness. Require callback verification to known-good numbers. Use out-of-band authentication. Make it policy that no credentials are reset without additional verification steps, period.

Second: train your help desk staff specifically on vishing. Not general security awareness—actual scenario-based training where they practice saying no and following escalation procedures. Include recordings of vishing calls so they hear what social manipulation sounds like.

Third: log everything. Every call, every reset request, every unusual access attempt. Then actually review those logs. Patterns emerge when you're looking for them.

Your help desk isn't a liability if you treat them like the front-line defenders they are.

Read original article →

// FAQ

What is vishing and how is it different from phishing?

Vishing is voice-based phishing conducted over phone calls rather than email. It targets human psychology through conversation rather than malicious links, making it harder to detect with technical controls.

Why is SLH specifically targeting women for these vishing attacks?

Research shows that help desk staff often lower their guard with callers perceived as non-threatening, and attackers exploit gender-based social biases to increase their success rate on credential theft calls.

What immediate steps should IT help desks take to prevent vishing attacks?

Implement mandatory callback verification to known-good numbers, require multi-factor authorization for password resets, and conduct regular vishing scenario training with help desk staff to recognize manipulation tactics.

// RELATED

#attack Malicious npm Packages Harvest Crypto Keys, CI Secrets, and API Tokens 2026-02-23 #attack Romanian Hacker Pleads Guilty to Selling Access to US State Network 2026-02-23 #attack ‘Starkiller’ Phishing Service Proxies Real Login Pages, MFA 2026-02-20

Concerned about your project's security? Run an automated pentest with AISEC — AI-powered scanner with expert verification. Go to dashboard →