Official alert describes support impersonation and MFA relay attacks
The Canadian authority warns of calls impersonating internal support that lead to fake pages. The observed campaign is Canadian; the techniques provide a basis for reviewing support procedures in Spain.
News summary
Alert AL26-028 of 28 October describes a voice phishing campaign targeting Canadian organisations, including the legal and financial sectors. Attackers pose as internal IT support and use pretexts such as migration to passkeys, MFA enrolment or urgent password changes to direct employees to a fake login page.
The authority states that the campaign uses real-time relay attacks to bypass conventional MFA and frequently changes its deceptive domains. A domain blocklist is therefore not enough. The advisory does not confirm a campaign against Spanish companies; its local value lies in reviewing how employees verify support requests and authentication changes.
Source: Canadian Centre for Cyber Security — 28 October 2026
What to review in your business
Establish a callback procedure using a known channel obtained independently. Do not use the number or link supplied by the person requesting the change.
Consider phishing-resistant authentication where supported and review the procedure for enrolling authentication methods. An MFA code or approval requested by a stranger may be part of the attack.
Concepts mentioned in this article: Phishing
At Seintec, we help you review affected systems and prioritise protective measures according to your environment. Contact our team.
Contact SeintecRelated service
Cybersecurity
We shield your business so it never stops.