One attack, many channels, one USB drive

Every step of the sequence uses a different channel

The FBI describes the sequence in order. First, an email posing as an IT, invoice, billing or subscription notice urges the employee to call a phone number. The actor then poses as IT support, either when the employee calls or when the actor calls directly.

Next, the actor asks the employee to open a remote desktop session with tools such as Quick Assist, AnyDesk or Splashtop. If remote access fails, an actor visits the office. The visitor plugs a storage device into the computer and says it is needed to image the device or create a backup (FBI FLASH-20260526-01, May 2026).

Once inside, the actor copies data out with tools such as WinSCP or Rclone, or onto the USB drive in person. The extortion then arrives by email, and the actor also calls employees or clients to add pressure.

Read as a list of channels, it covers an email or text, a phone call, a remote desktop session, a physical visit and an extortion campaign by email and phone. Each one does a different job. The email earns the call, the call earns the access, and the visit covers the case where access fails.

Each channel has an owner, and the sequence has none

Security teams usually organize their controls by channel. The email gateway watches email. The IT or telephony team handles calls. Endpoint tools watch remote access software. Facilities handle visitors. A text message often has no owner at all.

In this sequence, each of those teams sees a plausible fragment. The first email asks for a phone call, so a filter has little to weigh beyond the sender and the wording. The call leaves no file to scan. The remote access tools are legitimate software that employees and IT teams already know.

Even the visitor fits the story. According to The Register, the in-person actors pose as IT staff and say they need to assess the damage from the phishing email (The Register, May 27, 2026). The last step refers back to the first.

The pivot is the signal

A sequence can imitate each step convincingly, but it cannot avoid the moment it changes channel. An employee gets an email, then a call that refers to it. Later, a visitor arrives and refers to the same email.

That moment is the one place where an employee holds information no tool has. The email and the call belong to the same story. A filter cannot know that the call is about the email. The employee can.

This changes what is worth training. Spotting a bad email is one skill. Noticing that a request has moved from one channel to another, and treating that move as a reason to verify, is a different one.

What this means for security teams

Map ownership before mapping controls. Write down who watches email, texts, calls, remote access sessions and visitors, and what happens when a case touches three of them. If the answer is a conversation nobody has scheduled, the sequence will find that gap.

Give people one place to report. An employee who gets an email, a text, a call or a visitor should use the same route. That way the reports land in one queue and someone can put them side by side.

Adopt a pivot rule. When a request on one channel refers to another, such as a call about an email, the employee verifies it through a number or contact they find themselves. The FBI's own recommendations include setting IT verification policies.

Test the whole sequence, not each channel alone. A tabletop exercise or simulation that moves from email to phone to a visitor shows whether anyone notices the pivot. At Zepo we built our Multiattack Simulations around that idea.

Attackers need an employee who sees one step at a time. Measuring whether people notice the pivot gives security teams a signal that no gateway can report.

FAQ

What is a multichannel social engineering attack? It is an attack that moves across email, text, phone calls, remote access or in-person contact to build trust step by step. Each channel does a different job, and each is usually watched by a different team or tool.

‍

What is callback phishing? It is an email or text that asks the target to call a phone number instead of clicking a link, so the conversation with the attacker happens by voice. The FBI describes it in its May 2026 alert on Silent Ransom Group (FBI FLASH-20260526-01, May 2026).

‍

Why do email filters not stop sequences like this? A filter only sees the first step. The call, the remote session and the visit happen outside the email system, so no single tool sees the whole sequence.

‍

What should an employee do when a call refers to an email? Verify the request through a contact the employee finds independently, not the number in the message, and report both the email and the call to the same security route.