Check Point says fake voicemail phishing targeted more than 7,800 organisations

Check Point has detailed a credential-phishing campaign that disguised its lure as an automated voicemail transcript. Its 14 September disclosure describes internal-looking sender addresses and script-capable SVG attachments used to place a redirect to a credential-harvesting page behind a supposed call recording.

The company says its telemetry identified more than 58,000 campaign emails between 17 August and 31 August 2026. According to Check Point, the messages targeted more than 7,800 organisations and used more than 38,400 spoofed sender addresses across more than 9,300 spoofed domains.

All of those counts are Check Point’s claims and have not been independently corroborated. TechRadar’s secondary report was based on the same disclosure and did not add separate victim confirmation or campaign telemetry. The figures measure targeting, not successful credential submission, account compromise or data access. The public material does not establish how many messages reached inboxes or were opened.

How the voicemail lure worked

The messages were designed to resemble automated notifications for voicemail transcripts. Check Point found that sender addresses had been spoofed to resemble the recipient organisation’s own domain, giving each email an internal appearance.

The lure carried an SVG attachment presented as a call-recording file. Rather than putting the redirect in a visible email-body link, the attachment used the SVG format’s ability to contain active content. Check Point’s analysis says embedded script sent a recipient to a credential-harvesting page when the file was opened.

The destination incorporated another layer of personalisation. The recipient’s email address was encoded in the redirect URL, allowing the harvesting form to pre-fill that address. The public findings do not identify the identity providers or brands shown on the pages.

No software vulnerability was identified in this chain, and the report does not assign a CVE or name an affected product. The method instead relied on social engineering, sender-address spoofing and the active-content capability of SVG attachments. That does not mean all SVG files are malicious, or that these attachments universally bypassed email security. The published material does not provide email-authentication results or show how often deployed controls stopped the messages.

What the evidence does not show

Check Point did not name or technically attribute the campaign to a threat actor. Its disclosure also provides no public victim list, country or regional distribution, industry breakdown, organisation-size data, or confirmed operational impact.

The available evidence therefore supports describing a credential-phishing campaign, but not a breach, account takeover or confirmed theft of credentials. There is no evidence in the public material that a targeted account was accessed or used for a further intrusion. Check Point’s quantified observation period ended on 31 August, and activity after that date has not been confirmed.

Defences for users and automated agents

For users, the practical guidance is to verify automated voicemail and transcript notifications even when the sender appears to use the organisation’s own domain. Security teams should treat SVG attachments as active content and inspect them accordingly. A clear reporting route for suspicious automated messages can also help defenders identify and block related infrastructure.

Check Point also set out forward-looking safeguards for automated and AI agents that process inbound email. Organisations can define which file types and domains those agents may access without human confirmation, then log and review their actions in the same manner as privileged-user activity. This advice does not establish that AI generated, operated or was targeted by the campaign.

These steps are mitigations rather than patches or fixed versions because the report identifies no product flaw. Rather than a general warning about SVG files or personalised phishing, the disclosure documents a bounded campaign combining recipient-domain spoofing, a script-bearing attachment and a pre-filled email field.

No country breakdown or Australian victim information was published, so the campaign should not be presented as an Australian incident. It remains generally relevant to Australian organisations using enterprise email and automated voicemail or transcript workflows. Whether the activity continued beyond Check Point’s observation window, or any targeted account was compromised, remains unverified.

A script-capable SVG attachment turns a routine-looking voicemail notification into a file-handling question. Readers can investigate the wider foundations through The Hack Academy’s online cybersecurity training programme, with self-paced learning and practical exercises alongside theory in cybersecurity fundamentals and internet vulnerabilities.