BazarCall  (Back to overview)

aka: BazzarCall, BazaCall

BazarCall campaigns forgo malicious links or attachments in email messages in favor of phone numbers that recipients are misled into calling. It’s a technique reminiscent of vishing and tech support scams where potential victims are being cold called by the attacker, except in BazarCall’s case, targeted users must dial the number. And when they do, the users are connected with actual humans on the other end of the line, who then provide step-by-step instructions for installing malware into their devices.

Associated Families

There are currently no families associated with this actor.

2022-10-06TrellixDaksh Kapur
@online{kapur:20221006:evolution:788af5e, author = {Daksh Kapur}, title = {{Evolution of BazarCall Social Engineering Tactics}}, date = {2022-10-06}, organization = {Trellix}, url = {}, language = {English}, urldate = {2023-01-03} } Evolution of BazarCall Social Engineering Tactics
BazarBackdoor BazarCall
2021-07-29MicrosoftMicrosoft Defender Threat Intelligence
@online{intelligence:20210729:bazacall:a24d9e6, author = {Microsoft Defender Threat Intelligence}, title = {{BazaCall: Phony call centers lead to exfiltration and ransomware}}, date = {2021-07-29}, organization = {Microsoft}, url = {}, language = {English}, urldate = {2023-01-03} } BazaCall: Phony call centers lead to exfiltration and ransomware
BazarBackdoor BazarCall

Credits: MISP Project