Threat actors may use voice communications to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex:Â Impersonation) and/or creating a sense of urgency or alarm for the recipient.
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.