How to stop multichannel cyberattacks

Sponsored by

AI agents are starting to do more than access systems. They can invoke tools, execute workflows, and take action across business applications. As that autonomy grows, IT needs visibility into what each agent is allowed to do, what it actually did, who owns it, and how to revoke access when needed. Learn how JumpCloud helps govern AI agents alongside human and device identities.

Like your friend who’s tuned into NFL RedZone every Sunday, threat actors these days are on many channels at once.

In these “omnichannel” or “multichannel” attacks, an adversary might send a fake password-reset email, then phone a minute later, pretending to be the help desk. They may even follow up with a message on an internal comms platform. By reaching out on three different channels, there’s a greater chance an attacker may appear authentic, especially to a harried employee.

“They’re very calculated pathways meant to create trust,” Chris Nyhuis, co-founder and CEO of cybersecurity firm Vigilant, said of this attack tactic.

This year, vendor security teams have disclosed instances of attackers using multiple communication methods in quick succession. For instance, Microsoft, in September, revealed a convincing combination of social engineering and realistic infrastructure to collect targeted data:

• A threat actor claiming to be a help-desk employee calls (or texts) a target’s personal phone number
• The adversary directs the employee to a website closely resembling a Microsoft sign-in page. The replica site offers a chance for attackers to steal session tokens and credentials.
• In a subset of cases, the fraudster used a trusted employee identity to send lures via Microsoft Teams.

“The actor appears to invest heavily in pre-attack research, likely gathering information about employees and organizational structure from public sources such as social networking and professional profiling platforms,” the Microsoft Security Research team wrote on September 9.

In July, cybersecurity company Sophos shared how a threat group initiated contact with potential victims through Teams chats and calls, impersonating help desk or IT support staff (with plausible usernames). The operators also created IT-themed cloud domains under the “.top” top-level domain (TLD), in attempts to gain remote access.

Why multichannel works. A multichannel attack’s additional platforms add layers of convincing authenticity; a second point of contact feels corroborative rather than suspicious.

“They’re making people trust and not verify,” said Anthony Oren, CEO of managed security services provider Nero Consulting, who is seeing a “dominant pattern in 2026” of attackers combining scams that use email, QR codes, and phone calls.

Why multichannel takes effort. But multichannel attacks require coordination. A threat actor may have to build introductory emails that match a target company’s style, right down to the signature. To do that, threat actors may email different employees or the help desk and wait for replies.

With AI, that kind of research potentially goes from weeks to days according to Nyhuis. In a follow-up email to IT Brew, Nyhuis wrote that today’s AI can comb through sources including LinkedIn, press releases, company sites, job postings, public schedules, and social media to map a company’s org chart, learn execs’ communication styles, identify important software vendors, and see when a CEO is traveling.

A study from security awareness training provider SoSafe, conducted from September and October 2025, found that more than a quarter (28%) of 100 security and IT leaders reported an increase in “multichannel attempts that combined email, calls, or SMS within the same campaign.”

Counterprogramming. Microsoft, in its September findings, provided recommendations for defenders, like reviewing newly registered authentication methods and devices for users with risky or unusual sign-in methods.

Sophos, in its report, advised teams to establish procedures for investigating contact with external parties, “especially interactions that attempt to persuade users to launch remote support tools, download software, or grant system access.”

While Oren noted the importance of strong endpoint security technology and detecting anomalous behavior, he also suggested a low-tech solution: a password for sensitive transactions, communicated verbally but not written down anywhere.

Nyhuis suggests employers route remote users through “the right number of company-controlled internet gateways for their workforce,” he wrote in his follow-up, whether that’s a virtual private network (VPN), a cloud security gateway (which provides network security and filtering between an end user and cloud destination), or both. Without a gateway, a remote worker clicking on a phishing link at home just leaves a record in the cloud platform, like a Microsoft 365 log, the CEO told IT Brew.

For Nyhuis, the main strategy involves bringing together an increasingly remote workforce in one channel: “The biggest thing is centralizing again.”