Key takeaways
- On October 28, 2026, the Canadian Centre for Cyber Security issued alert AL26-028: an ongoing voice-phishing campaign against Canadian legal and financial firms in which callers posing as IT staff steer employees to lookalike sign-in pages that relay the MFA response to the real identity provider, handing the attacker an authenticated session.
- Law.com reported on October 30 that four of Canada’s largest law firms, McCarthy Tétrault, BLG, Bennett Jones and Davies Ward Phillips & Vineberg, were breached in a coordinated wave; the RCMP’s National Cybercrime Coordination Centre issued a fraud alert to law societies on October 27.
- For privacy teams, a compromised Microsoft 365 session is a breach file, not an IT ticket: preserve the identity-provider and M365 audit logs, scope the mailbox and file access, and run PIPEDA’s real-risk-of-significant-harm test early. The alert says the campaign ends in data theft and extortion demands.
The caller ID says help desk. The caller knows your IT lead’s name, says there is a passkey migration deadline tonight, and texts you a link. The page carries your firm’s name and looks exactly like your login. You type your password, approve the MFA prompt, and get back to work.
That was the entire attack. The page relayed your sign-in to the real identity provider in real time, and your MFA prompt just handed a stranger an authenticated session in your name.
The paper trail was already written before most Canadians heard about it. On October 27, the RCMP’s National Cybercrime Coordination Centre issued a fraud alert about fake IT help-desk calls targeting Canadian law firms. On October 28, the Cyber Centre published alert AL26-028: ongoing voice phishing against Canadian organizations, concentrated on the legal sector in October and on finance and legal since July. On October 30, Law.com reported that four of Canada’s largest firms, McCarthy Tétrault, Borden Ladner Gervais, Bennett Jones and Davies Ward Phillips & Vineberg, had been breached.
The relay, in one paragraph
The technique has a name that reads like a bad translation: adversary-in-the-middle. The caller directs you to a subdomain that wears your organization’s name on a generic root domain, something like <yourfirm>.onetimesso[.]com or <yourfirm>sso[.]com. Those domains mix action words (activate, enroll, register, deploy) with authentication words (passkey, sso, mfa, 2fa). The page sits between you and your real login provider. You complete the real sign-in, MFA and all, on the attacker’s page, and the attacker walks away with the authenticated session. The Centre says the lure domains rotate often, which is its polite way of saying your blocklist will not save you.
What happens next is the part privacy teams should read twice. The actor registers their own MFA method to keep access, deletes the password-reset and MFA-change notifications so you never see them, then uses scripts and Microsoft Graph to pull data out of SharePoint and OneDrive. Then comes the extortion demand.
Why this one worked
The alert reads like a field report. Calls land on personal mobiles, office phones, and Teams. Caller IDs spoof the real help desk, and callers name actual IT staff and cite missed deadlines for credibility. The tell on their tradecraft: they hang up if you try to verify them independently. They know the one move that beats them.
Law firms are not an accident of targeting. One compromised partner mailbox holds privileged client communications and the personal information that makes extortion easy.
The control you thought you had, and the one the alert wants
| The attacker’s move | What “we have MFA” assumed | What AL26-028 prescribes |
|---|---|---|
| Real-time relay of the MFA response | MFA stops credential theft | FIDO2 keys, device-bound passkeys, or platform authenticators, especially for privileged users |
| Caller names your IT lead | Training covers this | Independent verification of unexpected IT calls through a trusted channel, regardless of caller ID or urgency |
| Registers their own MFA method | Email alerts catch changes | Monitor for suspicious MFA registrations and newly registered domains impersonating the organization |
| Scripts pull SharePoint and OneDrive | DLP watches the exits | Monitor scripted or high-volume M365 file access; managed-device conditional access; restrict sign-ins from VPNs, hosting providers, residential proxies |
| Inbound Teams calls from outside | Internal channels are trusted | Restrict external Teams, Webex and Slack communications to trusted users; review guest access |
Note the pattern: every row is a control that removes a human decision from the chain. The campaign does not defeat cryptography. It defeats a phone call.
The breach file you now owe
This is where the story leaves the security team and lands on your desk. A vishing compromise of a Microsoft 365 tenant is not an IT incident with a privacy footnote. It is a breach of security safeguards analysis under PIPEDA section 10.1: if there is a real risk of significant harm to an individual, the organization must report to the Commissioner and notify the affected individuals as soon as feasible. A law firm mailbox full of privileged communications and a SharePoint full of client files clears that bar without much debate.
The alert tells you what evidence to hold: preserve identity-provider and Microsoft 365 audit logs, review mailbox and file activity, revoke active sessions and tokens, reset credentials, and remove unauthorized MFA methods. That evidence is perishable: logs roll, sessions expire, and the extortion demand does not wait for legal review.
One thread stays open. The firms have confirmed the compromises, but none has said how many client files left the building, whether the OPC received breach reports, or what the extortion demands said. I will update this piece as the record fills in.
Actionable takeaway: This week, pick five accounts: your admin, your privacy officer, and three people who live in email. Move them to FIDO2 keys or device-bound passkeys, switch on the alert for new MFA registrations, and put the new help-desk rule in writing: nobody verifies an IT call on the channel the caller provided.
The next caller will sound like your help desk too. The difference will be that your accounts no longer answer to a phone call.