As security defenses have grown more effective, criminals resort to the easiest route of attack: people. Using real-time interactions like phone calls, chat windows, and text messaging, criminals impersonate IT support personnel and direct victims to spoofed login pages hosted on lookalike domains. While it may appear to be a normal login page, the site captures credentials, multifactor authentication codes, and clipboard data, granting attackers immediate access to the real sites and allowing attackers to “remember” their own devices for login later. Some of these attackers use AI agents, meaning they can do this at scale. One criminal can simultaneously attack hundreds of people without any need to care about who the target is or isn’t. The value of the victim’s resources is calculated after the attacker logs in, enabling the criminal to inventory the victim’s assets and plan next steps accordingly.
If you receive a call, text, chat, pop-up window, or any message claiming to be IT support, be suspicious. If they claim they’re from Pegasus, follow Pegasus protocols to ensure the caller is really us. If they claim they’re from another company you do business with, we suggest you hang up and call the company to ensure you’re not dealing with an unauthorized caller using a faked CallerID.
Have a question about this, or a tech tip you’d like us to cover? Contact Pegasus and let us know.
