Wall Street rethinks MFA as vishing attacks bypass defenses

By mid-2026, financial cyberattacks have evolved from traditional ransomware schemes to sophisticated identity-centric social engineering campaigns that exploit human trust and procedural weaknesses. Groups like UNC6671 have pioneered tactics involving phone-based vishing and help-desk impersonation, targeting employees’ personal phones to bypass multifactor authentication not by defeating it technically, but by convincing victims to willingly authenticate attackers. This shift enables adversaries to gain legitimate cloud access, automate data theft, and suppress security alerts, fundamentally altering the threat landscape in financial services.

The Apollo Global Management breach in July 2026 starkly illustrated how process failures in identity verification during credential resets serve as the Achilles’ heel in corporate defenses. Attackers impersonated IT help-desk personnel, persuading employees to visit spoofed login portals that harvested credentials and MFA tokens, a method described by James Azar as a process failure ‘‘one urgent-sounding phone call away from becoming next week’s breach notification.’’ This incident is part of a broader campaign targeting major private-equity firms like Blackstone, Bridgewater, and Bain Capital, underscoring a systemic vulnerability in identity-centric social engineering tactics across the financial sector.

Mitigating these identity-centric attacks demands urgent procedural reforms, including robust identity verification protocols for credential resets and independent callbacks to known telephone numbers rather than those supplied during interactions. Security experts advocate moving high-value users toward phishing-resistant authentication methods such as FIDO2 security keys and passkeys to reduce reliance on vulnerable human factors. As Austin Larsen of GTIG emphasizes, attackers heavily rely on voice phishing, exploiting personal mobile devices with urgent security update pretexts, while Joshua Bartolomie of Doppel warns that AI-driven impersonation techniques are accelerating, making trusted identities and channels increasingly weaponizable and necessitating defenses that detect and disrupt impersonation before it reaches critical targets.

By early 2026, a sprawling vishing campaign orchestrated by sophisticated attackers targeted over 200 U.S. financial institutions, including heavyweights like Blackstone, Apollo Global Management, Citadel, and KKR. These attackers employed cunning phone-based social engineering tactics, impersonating IT staff to trick employees into surrendering credentials and multi-factor authentication codes via spoofed websites. The campaign's financial toll was staggering, with at least $10.7 million in Bitcoin ransom payments tracked, ranging from $750,000 to $3 million per demand, underscoring the severe monetary impact of identity-centric extortion on top-tier financial firms.

While some targeted firms successfully thwarted these incursions or avoided data breaches, others capitulated to ransom demands, revealing persistent vulnerabilities in human-centric defenses despite advanced technical safeguards. Apollo Global Management, a $1 trillion asset manager, suffered a significant breach in July 2026 when attackers leveraged social engineering to infiltrate its cloud platforms, exfiltrating sensitive personal data including Social Security numbers and home addresses. This incident not only exemplifies the escalating threat low-tech social engineering poses to major financial institutions but also amplifies regulatory scrutiny and reputational risks, prompting Apollo to swiftly notify law enforcement, bolster security protocols, and offer identity protection services to affected individuals.

The social engineering breaches at financial institutions like Levi Strauss & Co. and Apollo Global Management reveal a troubling trend where attackers bypass technical defenses by exploiting human vulnerabilities, often through sophisticated tactics such as vishing and impersonation. Levi Strauss & Co.'s 2026 incident, which compromised three employee computers without exploiting software flaws, underscores how critical human factors have become in cybersecurity, while the lack of publicly available technical indicators of compromise hampers broader industry preparedness against these threats.

Despite rapid containment efforts that prevented operational disruption and consumer data compromise at Levi Strauss & Co., the exfiltration of unspecified corporate data still poses significant reputational and regulatory risks. The company’s transparent SEC disclosure, though withholding specific details about the stolen data and attacker identities, highlights the delicate balance firms must strike between regulatory compliance and managing public perception in the wake of social engineering breaches.

Apollo Global Management’s 2026 breach starkly illustrates the severe data exposure risks financial institutions face when social engineering exploits weak help desk processes, resulting in the theft of sensitive personal information including Social Security numbers and home addresses. As cybersecurity expert James Azar bluntly states, allowing credential resets over the phone without robust verification is a process failure that leaves firms vulnerable to costly breaches and ransom demands, as evidenced by the $750,000 ransoms reportedly paid by some private equity victims.

The rising tide of AI-enhanced social engineering attacks is amplifying the scale and sophistication of breaches targeting major financial firms such as Apollo, Blackstone, and Bain Capital. These campaigns leverage voice phishing and MFA token interception to circumvent advanced defenses, forcing institutions to urgently adopt phishing-resistant authentication methods and specialized help desk training. As Joshua Bartolomie of Doppel warns, organizations must now assume that trusted identities and communication channels can be weaponized, necessitating proactive defenses that detect and disrupt impersonation before damage occurs.

By mid-2026, traditional security measures like multi-factor authentication (MFA) have proven inadequate against sophisticated social engineering attacks, with LevelBlue reporting a 100% bypass rate of MFA in business email compromise cases. This alarming vulnerability is compounded by critical visibility gaps within organizations, as only 17% claim full oversight of AI agents and processes despite widespread generative AI adoption, leaving many blind to the evolving threat landscape.

Artificial intelligence has become a force multiplier for cybercriminals, dramatically enhancing the persuasiveness of ransomware and social engineering campaigns. According to LevelBlue, 65% of organizations affected by ransomware acknowledge AI’s role in making attacks more convincing, while 40% of users reportedly trust malicious messages crafted with AI assistance, underscoring a dangerous erosion of user skepticism that traditional defenses fail to address.

Recognizing the limitations of conventional cybersecurity tools and alert monitoring, the industry is witnessing a strategic pivot toward managed security service providers (MSSPs) who specialize in complex identity, cloud, API, and AI threat environments. Companies like ExtraHop, ThreatDown, 7AI, Keyfactor, and Veraify are leading this shift by offering tailored solutions that go beyond legacy defenses to tackle the nuanced challenges posed by AI-driven social engineering and identity-centric attacks.

By mid-2026, the persistent exploitation of phone-based social engineering, as seen in breaches at Levi Strauss & Co. and Apollo Global Management, underscored the urgent necessity for enhanced identity verification protocols at help desks. Attackers repeatedly leveraged vishing tactics to impersonate internal IT staff, manipulating trust to reset credentials and harvest MFA tokens, a vulnerability James Azar starkly described as a "process failure sitting one urgent-sounding phone call away from becoming next week’s breach notification." Strengthening these verification processes, including callbacks to independently verified numbers, is critical to closing this attack vector.

Employee training emerged as a cornerstone defense against increasingly sophisticated social engineering techniques, such as adversary-in-the-middle phishing portals and MFA manipulation. The Levi Strauss & Co. incident highlighted how attackers convinced staff to perform actions enabling unauthorized access, revealing that traditional annual security awareness courses are insufficient. Apollo’s breach analysis recommended targeted, scenario-specific help desk training delivered immediately to counter these evolving tactics, emphasizing the human factor as both a vulnerability and a frontline defense.

Adopting phishing-resistant authentication methods like FIDO2 security keys and passkeys, combined with continuous identity monitoring, is vital to prevent attackers from capturing and replaying MFA tokens or registering rogue devices. The Levi Strauss & Co. breach demonstrated how adversaries exploited MFA enrollment processes to maintain persistent access, a tactic echoed in Apollo’s recommendations to move privileged users toward stronger, phishing-resistant authentication. Continuous monitoring complements these measures by detecting anomalous identity behaviors before attackers can entrench themselves.

Enforcing least privilege access remains a fundamental strategy to limit damage from compromised accounts and devices, as evidenced by the Levi Strauss & Co. breach where three company-issued computers were compromised without exploiting software vulnerabilities. This approach is especially critical given that even financial giants like Apollo, Blackstone, Bridgewater, and Bain Capital fell victim to basic social engineering tactics, revealing that accountability and strict access controls are as crucial as technical defenses in mitigating identity-centric attacks.