An organization's helpdesk reports that users are receiving calls from someone claiming to be IT support asking them to reveal their passwords or run remote access tools. What type of attack is this?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — this is vishing, a voice phishing social engineering attack where someone pretends to be IT support over the phone to trick you into giving passwords or running remote access tools. It's not email phishing, website compromise, or vendor compromise because the attack happens through phone pretexting.
Full Explanation
The correct answer is the vishing (voice phishing) / social engineering pretexting attack targeting user credentials, because calls from someone impersonating IT support to obtain credentials or access is vishing (voice phishing), a social engineering technique using phone pretexting to manipulate users into revealing information or taking harmful actions. The spear phishing via email option is wrong because spear phishing uses targeted email, not phone calls. The watering hole attack targeting the helpdesk website option is wrong because a watering hole attack compromises websites frequented by the target, not phone interactions. The supply chain attack via a compromised IT support vendor option is wrong because a supply chain attack compromises vendor software or hardware; this is a direct social engineering call, not a supply chain vector.