Smooth criminals talking their way into cloud environments, Google says
What happened
RSAC 2026 Voice phishing surged last year to become the second most common method used by cybercriminals to gain initial access to their victims' IT estate – and the No. Groups like ShinyHunters and Scattered Lapsus$ Hunters increasingly used this and other types of interactive social engineering tactics that involve a human steering the conversation in real time in their 2025 attacks, according to Jurgen Kutscher, VP of Mandiant Consulting at Google Cloud. This matters for IT, Telecom & Cyber because the signal changes the near-term supplier conversation, especially around price discipline, optionality, and execution readiness
Buyer takeaway
For IT, Telecom & Cyber, this is mainly an availability and execution signal; sequencing, fallback coverage, and supplier responsiveness may matter more than list price
Cost / money
Tighter availability often shows up later as expediting, standby, or substitution cost. The immediate job is to see where delays could become avoidable spend
Supplier / commercial
Capacity pressure usually strengthens supplier leverage. Check who can still commit on timing, what backup coverage exists, and whether current contract language protects against slippage
Safety / operations
Where supplier availability tightens, schedule pressure can spill into safety or quality risk if teams start accepting late substitutions or compressed mobilization windows
What to watch
Watch lead times, crew or vessel allocation, and whether suppliers are quietly narrowing commitment windows before the next sourcing gate
Key facts
- RSAC 2026 Voice phishing surged last year to become the second most common method used by cyb
- Groups like ShinyHunters and Scattered Lapsus$ Hunters increasingly used this and other types
- "It's the interactive ones, the voice based ones, that are really creating a new challenge,"
- The report found attackers used voice-based phishing as the initial infection vector in 11 pe
