What does a callback phishing attack cost?

Average successful callback-phishing incident is $1.10M. The figure trails AitM and BEC because the call-conversion rate is lower, but the per-conversion outcome is heavy because the attack frequently terminates in a ransomware deployment.

Why is callback phishing hard to filter?

The lure email contains no malicious URL, no malicious attachment, and no obvious credential-harvest content. It contains a phone number. Email-gateway content scanners cannot meaningfully evaluate whether a phone number in an email is malicious because phone numbers in invoices and customer-service emails are routine and legitimate.

What was the Bazarcall pattern?

Bazarcall (also Bazaloader, Bazar Call) was a callback-phishing campaign run by the Conti / TrickBot operators through 2020-2022 that delivered Bazaloader malware via callback to a fake subscription-cancellation hotline. The campaign was the canonical demonstration of the callback pattern at scale and inspired multiple subsequent imitators after Conti's leak in early 2022.

What is the ransomware-handoff economics?

Callback-phishing operators typically pre-sell the access they obtain to ransomware affiliates rather than running the ransomware themselves. The handoff price for a corporate-network foothold ranges from $5K to $50K depending on revenue and access depth. The ransomware affiliate then runs the downstream extortion and shares proceeds with the affiliate program operator.

What stops callback phishing?

The single most-leveraged control is a hard organisational rule that no employee should ever call a phone number from an unverified email to dispute a charge or cancel a subscription. Combined with behavioural-email-security flagging of phone-number-only lures and SOC visibility into outbound calls to suspect numbers, the attack class can be reduced materially.

Filing 02.09.00Field 27 APR 2026Classification PublicStatus Open

Callback phishing (TOAD): the phone-number-only lure that bypasses every email filter

Q: What is callback phishing?

Callback phishing, also called TOAD (Telephone-Oriented Attack Delivery) or Bazarcall, is a phishing pattern where the lure email contains no malicious URL or attachment but instead asks the victim to call a phone number to dispute a fake charge or cancel a fake subscription. The phone-call branch of the attack delivers the malicious payload through social engineering or remote-access tool installation.

Average successful callback-phishing incident: $1.10M. The Bazarcall lineage proved the model at scale; modern operators run it as a ransomware-affiliate pipeline. The lure contains no URL and no attachment, only a phone number, which defeats content-scanning by design.

Exhibit A

Why callback phishing is structurally novel

Callback phishing inverts the standard email-phishing payload model. The lure email contains no malicious URL, no malicious attachment, and nothing that an email-gateway content scanner can flag as suspicious. The lure contains a phone number, presented in the body of what looks like a routine invoice, subscription confirmation, or charge-dispute notification. The victim, alarmed by an unexpected charge or unfamiliar subscription, calls the phone number to dispute or cancel. The attacker, operating the phone number on the other end, then delivers the malicious payload through a social-engineering conversation that frequently ends with the victim installing a remote-access tool on their machine.

The pattern is structurally novel because every defensive layer the email-security industry built between 2010 and 2022 was oriented around scanning URLs and attachments for malicious content. A phone number in an email body is not a URL and is not an attachment; it is plain text. Email gateways have no meaningful way to evaluate whether a phone number is malicious because phone numbers in invoices, customer-service emails, and shipping confirmations are routine. The defender problem is that the malicious content lives entirely outside the email message in the subsequent phone conversation.[Proofpoint TOAD research 2022-2024 + Mandiant M-Trends 2024]

Exhibit B

The Bazarcall lineage: from Conti pilot to commodity pattern

CASE FILE

The Bazarcall (or BazaCall, also Bazaloader) campaign run by the Conti / TrickBot operators through 2020-2022 was the canonical demonstration of callback phishing at scale. The lure was an invoice or subscription-renewal email that referenced a small dollar amount (typically $50 to $200) for a software or streaming-service subscription the victim had never purchased, with a phone number to call for cancellation. Victims who called were walked through downloading a fake cancellation tool that was, in reality, the Bazaloader backdoor. The backdoor established persistent access that Conti subsequently used to deploy ransomware.

The Bazarcall operators ran the campaign as a high-volume pipeline. Independent estimates from Proofpoint and Microsoft place 2021-2022 daily lure volume in the hundreds of thousands of emails, with call-back conversion rates of approximately 0.5 to 1.5 percent and successful-payload-install rates of approximately 30 to 50 percent of callers. The per-victim ransomware deployment that followed was the high-cost terminal event in the chain.

The 2022 leak of Conti's internal chat logs (the so-called Conti leak) exposed the operational details of the Bazarcall pipeline, including the call-centre infrastructure, the script-library for callers, and the financial split with downstream ransomware affiliates. The leak was simultaneously a major boost to defender intelligence and a how-to manual for the next generation of operators. Multiple post-Conti groups (including Quantum, Royal, and several Black Basta affiliates) have run callback-phishing campaigns through 2023-2025 using techniques directly traceable to the leaked Conti playbooks.[Conti leak Feb 2022 + Proofpoint TOAD research 2022-2024 + Mandiant M-Trends 2024]

Exhibit C

The phone-call branch: what actually happens after the victim dials

The phone-call branch is the part of the attack that defenders have least visibility into. A reconstructed transcript from public incident-response work suggests the following pattern. The caller hears a professional-sounding contact-centre answer with hold music and an interactive voice response menu. The script presented to the caller is consistent with a real subscription-cancellation flow. The caller is asked to verify their identity, told that the cancellation cannot be processed without their assistance, and walked through visiting a URL or downloading a cancellation tool. The tool is the malicious payload.

The social-engineering quality of the call branch has improved through 2023-2025 with the same voice-cloning and conversational-LLM technology that has driven the vishing surge (see /by-attack/vishing). Modern callback-phishing operators can run the call branch entirely autonomously through a conversational-AI agent that handles the script, manages the IVR, and walks the victim through the payload installation. The labour cost of running a callback campaign has dropped materially as a result, and the call-quality has improved enough that even alert callers report the experience as indistinguishable from a real customer-service call.

The post-payload pivot is typically rapid. The remote-access tool the victim installed gives the attacker access to the victim's machine and, depending on the victim's privilege level and the corporate environment, access to broader internal resources. Within hours the attacker has established persistence, enumerated the environment, and either deployed ransomware directly or sold the access to a ransomware affiliate. The handoff price for a corporate-network foothold sold to ransomware affiliates runs $5K to $50K in the underground market depending on the target organisation's annual revenue, the access depth obtained, and the speed of the handoff.[Proofpoint + Mandiant transcript reconstruction 2023-2025]

Exhibit D

Cost-line build-up against the $1.10M figure

Cost line	Share of $1.10M	Dollar figure	Driver
Ransomware response and recovery	42%	$462K	Frequent ransomware-pipeline terminal
Incident response + forensics	16%	$176K	Phone-call attribution work, network forensics
Pivot containment	13%	$143K	Lateral-movement from victim host
Notification + monitoring	10%	$110K	If exfil scope triggered notification
Endpoint reimaging at scale	8%	$88K	Standard post-RAT-install practice
Legal + class-action exposure	6%	$66K	Lower than data-loss-only events
Awareness + helpdesk-script overhaul	5%	$55K	Mandatory post-event

The ransomware-response line dominates because callback phishing terminates in ransomware deployment more often than other phishing vectors. Where the pipeline does not reach ransomware (caught at the pivot-containment stage), the per-event cost drops to approximately $400K.[IBM 2025 callback-vector cohort + Mandiant 2024 ransomware-handoff economics]

Exhibit E

Controls: training-first, behavioural second, SOC-visibility third

#1Hard organisational rule: never call phone numbers from email

~70% of victim-call rate

Cost: $0 tooling, policy work

A simple, well-communicated rule that any phone-number-driven dispute or cancellation goes through the company's known customer-service number, never the number in the email. Cheap, high-leverage, but requires sustained reinforcement because the lure exploits genuine consumer fear about unexpected charges.

#2Behavioural email security with phone-number-only lure flagging

~55% of lure delivery

Cost: $42 to $96 per mailbox per year

Modern behavioural email-security platforms (Abnormal, Proofpoint TAP, Tessian-class) can flag the signature pattern of TOAD lures: invoice-shape, no URL, no attachment, prominent phone number from a phone-number-block known to be associated with callback campaigns.

#3SOC visibility into outbound calls to suspect numbers

~40% of call-branch completion

Cost: UCaaS-integration work, typically $20K-$80K

Integration between the corporate phone system and SOC tooling that flags outbound calls to phone numbers on commercial threat-intelligence feeds. Catches the call attempt in real time before payload delivery.

#4EDR with RAT-install detection on user endpoints

~80% of post-install pivot

Cost: EDR licence (typically $40-$100 per endpoint per year)

Endpoint detection-and-response catches the remote-access-tool install if the EDR has been deployed and tuned. Late in the chain but the last line before the attacker establishes persistence.

#5Standing rule: helpdesk never installs unfamiliar tools at user request

~30% of helpdesk-assisted install rate

Cost: $0 tooling, runbook update

Some callback-phishing operators escalate from the victim to the helpdesk, asking the helpdesk to install the cancellation tool. A hard helpdesk rule prevents the assisted-install pivot.

#6Targeted awareness module on callback phishing

~20% of click rate over 12 months

Cost: $2 to $5 per user per year incremental

Vendors including KnowBe4, Hoxhunt, and Cofense ship callback-specific simulation modules. Trains users on the no-URL invoice pattern as a distinct lure type.

Exhibit F

The 2023-2025 wave: Quantum, Royal, Black Basta affiliations

Post-Conti callback-phishing has been run as a service-layer attack by multiple ransomware affiliates. Quantum Locker (active 2022-2023, since rebranded multiple times) used callback as a primary initial-access mechanism. Royal Ransomware (active 2022-2024, now operating as BlackSuit) ran similar campaigns. Black Basta affiliates have used callback patterns through 2023-2025 with progressively more polished call-branch infrastructure.

The structural pattern across these groups is the separation between the callback operator (who runs the lure and call infrastructure) and the ransomware operator (who runs the downstream deployment). The handoff is transactional: the callback operator sells the established foothold to the ransomware affiliate for a fixed price, typically $5K to $50K depending on the victim profile, and the ransomware affiliate runs the extortion. This affiliate-economy structure means defender attribution is frequently muddled because the callback operator and the ransomware operator may be entirely separate organisations.

The defender implication is that disrupting callback phishing requires disrupting the affiliate economy as well as the technical infrastructure. CISA, FBI, and international law-enforcement partners have made progress on this through 2024-2025 with sanctions designations against several ransomware operators and takedowns of multiple affiliate-recruitment forums. The effect on the underground market has been to compress affiliate margins and slow the on-ramp for new operators, but the established players have largely persisted.[CISA + FBI ransomware advisory tracker 2024-2025 + Mandiant M-Trends 2025]

Exhibit G

Frequently filed questions

ON RECORD

What is callback phishing?[open]

A phishing pattern where the lure email contains a phone number to call instead of a malicious URL or attachment. The malicious payload is delivered through the phone-call branch via social engineering or remote-access-tool installation.

What does callback phishing cost?[open]

$1.10M average per successful incident. Dominated by the ransomware-response line because callback frequently terminates in ransomware deployment.

Why is it so hard to filter?[open]

The lure email contains no URL and no attachment. The malicious content lives in the subsequent phone conversation. Email gateways have no meaningful way to evaluate whether a phone number in an email is malicious.

What was Bazarcall?[open]

A 2020-2022 callback-phishing campaign run by the Conti / TrickBot operators that delivered Bazaloader backdoor via callback to fake subscription-cancellation hotlines. The canonical demonstration of the model at scale.

Is AI changing callback phishing?[open]

Yes. Voice-cloning and conversational-LLM technology have automated the call-branch script and improved call quality. Modern operators run the call branch entirely autonomously through conversational-AI agents.

What is the ransomware-handoff price?[open]

$5K to $50K per corporate-network foothold sold to ransomware affiliates, depending on the victim organisation's revenue, access depth, and speed of handoff.

What is the highest-leverage defence?[open]

A hard organisational rule that no employee should ever call a phone number from an unverified email. Combined with behavioural-email-security flagging of phone-number-only lures.

Exhibit H