Over 58,000 phishing emails. Nearly 8,000 targeted organizations. All of it disguised as a routine voicemail notification. According to Android Headlines, Check Point Research has exposed a phishing campaign that ran between August 17 and August 31, using fake automated voicemail transcripts to steal employee login credentials at scale.
The mechanics are worth understanding. Automated voicemail transcription is a completely normal feature in most corporate environments. Employees get an email, read a short text version of a voicemail, and move on with their day. No one listens to every voicemail. Attackers clearly know this, and they built a campaign around it.
The fake emails mimic the format almost perfectly. Subject lines began with “Automated transcript,” followed by a partially hidden phone number and a random-looking tracking code, exactly the kind of detail that makes something feel legitimate. Each email included an attachment that appeared to be a short call recording. But it wasn’t audio. It was an SVG file, a format built for vector graphics, not sound.
That detail matters. SVG files can contain executable code, and security tools often treat them differently from standard document formats. When a recipient opened the file, the embedded code launched a fake login page in their browser. The victim’s email address was already baked into the link, so the page auto-filled the username field. The only thing left to do was type a password, and once they did, it was gone.
The scale of the infrastructure behind this is not trivial. Check Point Research found more than 38,400 spoofed sender addresses spread across over 9,300 spoofed domains. That kind of breadth makes blocklist-based defenses nearly useless. By the time one domain gets flagged, dozens of others are already in use.
This campaign fits into a broader shift in phishing strategy. Attackers are moving away from obviously suspicious emails toward messages that blend into normal workplace routines. Voicemail transcripts, invoice notifications, shared document alerts, these are all familiar enough that most people process them on autopilot. That autopilot is the vulnerability being exploited.
For organizations, the practical takeaway is uncomfortable: even emails that look completely routine, arriving from what appears to be an internal system, can be malicious. Email authentication protocols like DMARC help, but they are not enough on their own when attackers are registering thousands of look-alike domains. Employee awareness still matters, but asking workers to manually scrutinize every notification email is not realistic at scale. Security teams need to treat SVG attachments with the same suspicion they give to executable files, and unexpected login prompts triggered by email links should be a hard stop, not a minor inconvenience.