Attackers pick Levi's pockets in social engineering attack
- ID
- 12761
- Status
- summarized
- Published
- 10 Aug 2026, 9:36 PM
- Fetched
- 11 Aug 2026, 12:34 AM
- Provider
- The Register
- Category
- technology
- Original URL
- https://www.theregister.com/security/2026/08/10/attackers-pick-levis-pockets-in-social-engineering-attack/5285401
- Source URL
- https://www.theregister.com/headlines.atom
Summary
- Score
- 5.5
- Created
- 11 Aug 2026, 12:37 AM
- Tags
- Audience
- developerssaas_founders
What happened
Levi Strauss disclosed a data breach after social engineering attackers gained access to three employee workstations and exfiltrated corporate data. Google researchers are tracking a broader campaign (dubbed UNC6671) that has targeted 200+ organizations over five weeks, phoning employees on personal mobiles while posing as IT support and directing them to spoofed login pages that harvest credentials and MFA codes.
Why it matters
If you ship MFA-protected systems, this campaign shows attackers are reliably bypassing MFA via real-time phishing pages reached through phone-based social engineering—not by breaking cryptography. Consider whether your auth flow supports phishing-resistant factors (FIDO2/passkeys) rather than OTP codes that can be relayed through a spoofed page, and brief teams that IT support will never call their personal mobile asking them to log into a portal.
Discussion angle
The practical question is whether your product or org still treats SMS/app-code MFA as sufficient when attackers are actively harvesting those codes via phone-assisted phishing—and what it costs to move to passkeys or hardware keys instead.