TL;DR: Vishing (voice phishing) attacks broke into four of Canada’s biggest law firms in October. Criminals posed as IT staff on calls and Teams to steal account access and client files. The strongest defences are phishing-resistant sign-in and a simple rule that staff verify any unexpected IT request before acting on it.
What is vishing?
Vishing is phishing carried out by voice (voice phishing). The caller poses as someone your staff already trust, such as your own IT support. They then talk the person into handing over access.
It works because a phone call never passes through your email filters. The only thing standing between the caller and your systems is the person who picks up.
Microsoft Teams has made this easier for attackers. A call that appears to come from the helpdesk feels routine. That’s especially true in a busy firm where fee earners rarely meet the IT team in person.
How did vishing attacks break into Canadian law firms?
In late October, a coordinated campaign hit some of Canada’s best-known firms. McCarthy Tétrault, Davies Ward Phillips & Vineberg, Bennett Jones and Borden Ladner Gervais all confirmed breaches.
The attackers phoned staff or messaged them on Teams while posing as the firm’s own IT department. They raised password problems and security updates, then directed people to a fake Microsoft sign-in page.
At least seven employee accounts were compromised across the four firms. A source involved in the response told The Globe and Mail that around 31,000 files were taken from McCarthy Tétrault alone. Bennett Jones said the stolen data included client revenue reports. For some clients, it also included descriptions of the work the firm was doing for them.
The campaign used no software flaw. It relied on staff trusting a caller they believed was a colleague.
For a UK firm, the same breach would mean reporting to the ICO within 72 hours of becoming aware of it. It would also mean difficult conversations with every client whose files were taken.
Why didn’t multi-factor authentication stop the attackers?
The fake sign-in pages were built to get around multi-factor authentication (MFA). The page sat between the employee and the real Microsoft login, passing their details through as they typed.
The employee then approved the MFA prompt as normal. That gave the attacker the session that keeps a user signed in, so they had access without needing the password again.
Text message codes and app approvals can both be relayed this way. Passkeys and FIDO2 security keys are tied to the genuine website, so a fake page has nothing it can use. Our authentication solutions cover moving your firm onto stronger sign-in methods.
How can your law firm protect itself from vishing?
Start with a verification rule everyone knows. Nobody acts on an unexpected IT call or Teams message until they have called IT back on a number they already hold. Make it clear that genuine IT support should never need a password or an MFA code.
Next, look at who can contact your staff on Teams. If people outside your firm can message or call your team, limit it to the organisations you work with. Our Microsoft 365 support team can review these settings with you.
Your training needs to cover phone calls as well as emails. Most phishing exercises focus on the inbox, so a confident voice on a Teams call can catch people off guard. Fee earners juggling several matters are especially likely to go along with anything that makes a technical problem disappear. Our security awareness training helps staff recognise these approaches before they hand anything over.
Finally, keep watch on sign-ins. A login from a new device or location shortly after a helpdesk call is a strong warning sign. When an account looks compromised, revoke its active sessions, because a password reset alone may leave the attacker signed in. Managed security services give you that monitoring on an ongoing basis.
How can Labyrinth Technology help?
Labyrinth Technology has supported law firms across the UK for over a decade. We can review how your staff sign in to Microsoft 365. We can also help your team spot a fake IT call before it costs you client files.
If you would like to talk through where your firm stands, get in touch.
