New ADEX research shows how AI is making familiar scams cheaper and harder to detect, while fraudsters prepare to target AI shopping assistants.

Fraud prevention combines rules, AI and behavioral analytics to stop scams, reduce false declines and keep automated decisions explainable through human review.

A scanner impersonates 32 AI bots, including OpenAI and Claude crawlers, to search websites for exposed credentials, private keys and cloud configuration files.

Hackers impersonate IT support in Microsoft Teams external chats, tricking employees into granting remote access and installing malware on corporate computers.

INTERPOL’s Operation Serengeti III targeted cybercrime in 21 African countries, recovering over $105 million and identifying 65,929 victims…

Ocean Security found a phishing campaign, dubbed Phantom Preview, that abused legitimate Frame.io notifications and hidden PDF links…

Japanese police arrested a Chinese couple accused of hiding a computer in a Kobe hotel to send phishing emails and using stolen credit card details for purchases.

Microsoft and Health-ISAC seize domains linked to YAM Store, CoGUI and Iron Man, services that enabled over 1…

Picture a composite case drawn from documented scams where a tech professional spends forty minutes on a video…

Low-cost Android phones can arrive already compromised, with malware embedded in their firmware before buyers switch them on.

An Amazon Prime phishing campaign is using fake payment alerts to steal account logins, personal data and complete credit or debit card details from unsuspecting customers.

Students, job seekers and university staff, watch out for fake job offers sent from legitimate university email accounts.

Welcome back, aspiring cyberwarriors! 

If you’ve worked in an office, you’ve seen those phones on every desk. Some are wireless with a station, others look like regular landline phones. SIP is the language office phones use to sign in and start a call over the network. A phone call over the internet has two parts. First the two sides have to find each other and agree to talk, then the actual voice moves. SIP only handles the first part. The voices themselves travel on a separate path. That’s how most VoIP systems set up calls.

That’s why a stolen SIP password can be an issue. They are stealing the system’s belief that they are that desk phone. Once the handshake accepts them as an extension, say 1000, the phone system treats their laptop like that employee’s handset. They can place calls as other people and in many setups receive their incoming calls too.

Today we’re going to use SIPVicious against SIP and show you how it can be compromised.

Asterisk 

Asterisk is a program that understands SIP and runs the office switchboard. It decides who can sign in, what numbers exist, and who can call whom. It’s one of the most popular programs for SIP.

We set it up in our lab with Docker.

SIPVicious

Next thing we need to have installed is SIPVicious. The installation is pretty simple.

ubuntu > python3 -m venv sipvicious
ubuntu > source sipvicious/bin/activate
ubuntu > pip3 install sipvicious

The tool comes with 5 different commands: svmap, svwar, svcrack, svreport, svcrash.

Each of these commands has a help menu

ubuntu > sipvicious_svmap -h

We’ll use the first three commands for our test. The rest aren’t really important.

Identification

Using svmap we can find out what service the target is running.

ubuntu > sipvicious_svmap 127.0.0.1

Sometimes the results vary depending on whether you provide the extension. The extension is the phone’s account number.

ubuntu > sipvicious_svmap 127.0.0.1 -e 1000

You can look up the version and check whether it’s vulnerable to known exploits

Finding Account Numbers

Extensions are account numbers. They usually start at 1000. Old software will allow enumeration, but modern software ignores your requests, so you won’t be able to find out which accounts exist.

Still, it’s worth trying.

ubuntu > sipvicious_svwar 127.0.0.1 -e 1000-1010

You can also try –force and see what comes back. You’ll most likely see 401 Unauthorized, but that can vary depending on the software you’re testing.

ubuntu > sipvicious_svwar 127.0.0.1 -e 1000-1010 --force

Cracking Passwords

Even if we can look up extensions, we’ll start by trying common ones with our own credentials list. Let’s create a wordlist first.

# creating the list of credentials

ubuntu > printf ‘%s\n’ 1000 1001 admin password asterisk mrsip-lab > sip-pass.txt

ubuntu > sipvicious_svcrack 127.0.0.1 -u 1000 -d sip-pass.txt

mr-siplab was indeed our password for three of those accounts. This let’s take a look at two other ways of getting credentials without a wordlist. 

One option is to test the passwords the tool ships with. The default password set is a numeric range from 100 to 999

ubuntu > sipvicious_svcrack 127.0.0.1 -u 1000

You can also try the –enabledefaults flag. It adds common passwords, including the extension number itself.

ubuntu > sipvicious_svcrack 127.0.0.1 -u 1000 --enabledefauls

This didn’t work in our case, because the password was not predictable. 

We did have three contacts in our Asterisk setup though, and the tool successfully compromised all of them.

What Can Hackers Do

One of the biggest risks is toll fraud. Hackers can use compromised extension credentials to register to the system and place expensive international calls. That’s still the most common attack. Hackers can use compromised accounts to run vishing campaigns against other companies. If hackers are already inside and have the phonebook, they can convince employees and support teams to reset passwords, for example.

Summary

Modern software blocks enumeration of existing users, but it’s still possible given how much outdated software is out there. SIPVicious can identify the software in use and test common extensions for weak passwords. There are a few password attacks it can run with or without a wordlist. Sometimes knowing the version alone is enough to compromise a server and get into the network. Don’t overlook yours and regularly upgrade things.

The post Offensive Security: Pentesting Office Phones with SIPVicious first appeared on Hackers Arise.

Linkage analysis connects accounts, devices and infrastructure to detect coordinated fraud rings that traditional account-level risk controls may fail to identify.

Google Ads deliver a tech support scam kit that shows fake security alerts, makes browsers appear locked and…

Manifold Security found placeholder domains cited in 359,000 GitHub files and 349 AI agent skills serving cloaked scam…

Varonis Threat Labs discovered AvisLoader, a Windows malware loader that uses the Tox peer-to-peer network for C2 and arrives through a malicious ClickFix lure.

Microsoft disrupted EvilTokens after the AI-powered phishing service compromised 12,000 inboxes across 10,000 organisations and enabled complex financial fraud.

MovieReaper malware spreads through compromised Odyssey torrents, infecting hundreds of victims while using Solana to locate command-and-control infrastructure.

Fifty-three percent of organizations have had an executive or employee impersonated in targeted social engineering attacks over the past year, according to a new report from Outtake. Just over half of this impersonation activity took place on social media platforms using fake profiles, followed by video platforms.