Would one of your employees follow an urgent instruction from someone who sounded like your IT team? That uncomfortable possibility is at the centre of a current campaign targeting Canadian organizations, including firms in the legal and financial sectors.
On October 28, 2026, the Canadian Centre for Cyber Security issued Alert AL26-028 on an ongoing help desk voice phishing campaign. The alert says finance and legal organizations have been increasingly targeted since July, with October activity concentrated on the legal sector.
For GTA small and midsize businesses, the lesson is direct: a call that appears to come from your own IT help desk can be the first step in an account takeover. No geek-speak: we’ll explain how the scam works, why regular multi-factor authentication (MFA) may not stop it, and what your business can do this week.
How a phone call turns into a Microsoft 365 breach
The caller poses as an internal IT or help desk employee. They might say your team must urgently migrate to passkeys, enrol in MFA, or change a password. They could call a mobile or office phone, or contact an employee through Microsoft Teams.
The details can sound convincing. The caller may spoof a legitimate help desk phone number, refer to a real IT employee, or claim the recipient has missed a deadline. If the employee tries to verify the request independently, the caller may hang up.
Next comes a link to a sign-in page designed to look like the organization’s real login or enrolment portal. The page may include the company name in an unfamiliar web address. The Cyber Centre gives examples with domains such as org-name.onetimesso.com and org-name.registermymfa.com.
The page is not just collecting information to use later. It can pass the employee’s username, password and MFA response to the real sign-in service in real time. If the process succeeds, the attacker may receive an authenticated session, effectively, a temporary pass that can let them into the account.
Why MFA alone may not stop this attack
MFA adds an important layer of protection. But an MFA code or approval can still be captured if an employee is tricked into entering or approving it on a fraudulent page during a live sign-in.
Think of it like handing over a door code to someone who says they are from building management. The code may be valid, and the building’s security system may be working as designed. The problem is that the wrong person obtained the code at the right moment.
That is why this campaign is more than a suspicious phone call or a fake login screen. The caller creates trust and urgency, while the page relays sign-in information in real time. MFA remains valuable, but the method of verification matters.
What attackers may do after getting access
According to the Cyber Centre, reported activity after account compromise can include:
- Registering the attacker’s own MFA method or device to maintain access.
- Deleting password-reset, MFA-change and other security notifications.
- Resetting passwords for applications that do not use the organization’s central sign-in.
- Using automated scripts and Microsoft Graph to access and take data from Microsoft 365, SharePoint, OneDrive and connected services.
- Sending extortion demands after data theft.
For a legal, accounting or financial services firm, stolen files may contain client records, financial information, confidential correspondence or sensitive business documents. The impact can extend beyond the cost of restoring an account: it may involve operational disruption, client trust, reporting obligations and difficult decisions about stolen data.
Reactive vs. proactive: the difference is a process
Reactive IT waits for an employee to report a problem, then tries to contain it. Proactive IT makes the safe action clear before the pressure call arrives, and monitors for signs that something has gone wrong.
Think of it like car maintenance. A planned service appointment is usually easier to manage than waiting for a breakdown on the highway. In the same way, clear verification rules, secure account settings and monitoring can reduce the chance that a single convincing call turns into a business-wide incident.
Small businesses often have limited internal expertise and little appetite for unpredictable security spending. A practical plan does not need to be complicated. It does need an owner, a reporting route and clear instructions employees can follow when a caller insists something must happen now.
What your business can do this week
Use these steps to turn the alert into concrete action:
- Set a verification rule. Tell staff to end unexpected calls that request a password change, MFA enrolment or passkey setup. They should independently contact IT using a known number or established support channel, not a number, link or contact supplied by the caller. Caller ID and urgency are not proof.
- Give employees one reporting route. Make it easy to report a suspicious call or website, even if the employee did not click anything. The reporting channel should reach someone who can assess the event promptly.
- Review MFA and account recovery. Ask your IT team whether privileged and high-risk accounts can use phishing-resistant MFA, such as FIDO2 security keys or device-bound passkeys. Review how new MFA methods are added and how account recovery is approved. A request to change an authentication method should receive stronger checks than an ordinary support question.
- Check sign-in and file activity. Review whether your systems alert someone when a new MFA device is registered, security notices are deleted, or an account suddenly accesses or downloads a large volume of files. Consider shorter session lifetimes and access rules that require approved, managed devices where appropriate.
- Review collaboration tools. Check who can contact staff from outside your organization through Teams, Slack or similar platforms. Restrict external calls, messages and meeting invitations to trusted or business-required contacts where practical.
- Rehearse the first response. Spend 15 minutes walking through one scenario: an employee reports a suspicious call and may have entered their credentials. Confirm who can revoke sessions, reset credentials, remove unauthorized MFA methods and preserve Microsoft 365 and identity audit logs.
For ongoing protection, ITS Canada’s Cybersecurity & Network Protection services include security monitoring, access controls and Microsoft 365 security hardening. Managed IT Services can help establish consistent account-management and verification processes. Employees should also understand how to reach a real support team through your help desk process, and what your organization’s legitimate support team will and will not ask them to do.
If an employee may have responded, act quickly
Do not wait for proof of data theft before escalating. Contact your IT or security provider using a trusted channel. The Cyber Centre advises organizations to revoke active sessions and tokens, reset credentials, remove unauthorized MFA methods or devices, and review mailbox and file activity. Preserve relevant identity and Microsoft 365 audit logs for investigation.
If data may have been accessed or taken, involve the people responsible for your legal, privacy and client-notification obligations. ITS Canada’s Business Continuity & Disaster Recovery services can help businesses plan for disruption and recovery; incident response should be coordinated with the appropriate security, legal and organizational contacts.
Frequently asked questions
Does this mean we should stop using MFA?
No. MFA remains a valuable security control. The alert highlights why it should be combined with phishing-resistant methods where appropriate, secure account recovery, managed-device requirements and employee verification habits.
What if the caller ID shows our real help desk number?
Treat it as unverified. Caller ID can be spoofed. End the call and contact your support team using a phone number or channel you already trust.
What if an employee entered their password but did not approve an MFA request?
Report it immediately. The IT or security team should assess the account, review sign-in activity and determine whether credentials need to be reset or sessions revoked. Do not assume the account is safe because the employee did not notice an approval.
Is this only a concern for large companies?
No. The Cyber Centre alert describes activity targeting Canadian organizations, including legal and financial firms. Smaller organizations may also hold valuable client and business data, often with fewer internal resources to monitor accounts and investigate suspicious activity.
What can we do if we do not have a full-time security team?
Start with clear verification and reporting procedures, then ask a trusted IT provider to review MFA, account recovery, external collaboration access, alerts and incident response. A focused assessment can identify practical priorities without requiring your business to build an in-house security department.
How can ITS Canada help?
ITS Canada works with small and midsize businesses on managed IT, cybersecurity and help desk processes. If you want to understand where your current controls may need attention, request a low-pressure security assessment. The goal is to clarify your next steps, not add pressure during an already concerning news cycle.
