Cybercriminals are using a platform called Work Panel to convert fake technical support calls into organized campaigns that target corporate accounts across multiple identity providers.
The service integrates target reconnaissance, phishing page cloning, telephony infrastructure, and real-time credential capture into one control panel. It is attributed to the threat group tracked as O-UNC-045, also known as Cordial Spider.
Before placing calls, operators gather names, job titles, corporate email addresses, phone numbers, and professional profiles. This information allows the caller to impersonate help-desk personnel convincingly and tailor the approach to the victim’s role.
During the call, one operator maintains contact with the employee while a manager oversees the live phishing session. The fake page can request passwords, multi-factor authentication codes, push-notification approvals, or numeric confirmations.
Credentials are not delivered to the person making the call. Instead, they are forwarded exclusively to operation managers, who can copy them or receive them via Telegram, limiting opportunities for internal theft among the criminals.
Work Panel also automates domain registration, DNS configuration, and the creation of phishing pages that mimic Okta, Microsoft 365, and Salesforce login portals. New campaigns can be prepared within minutes.
The operation separates roles among callers, managers, and administrators. Each campaign runs in isolation, allowing rapid replacement of operators, rotation of infrastructure keys, and quick rebuilding after takedowns.
