---
title: "VPNs Under Attack as a Result of the Increase in Remote Work | DuoCircle"
description: "The first wave of pandemic-related phishing attacks targeted vulnerable employees and consumers."
image: "https://www.duocircle.com/images/og-default.png"
canonical: "https://www.duocircle.com/blog/phishing-protection/vpns-under-attack-as-a-result-of-the-increase-in-remote-work/"
---

Quick Answer

In August 2020, the FBI and CISA issued a joint advisory warning of a vishing campaign targeting VPN credentials at remote-first companies. Attackers stood up phishing sites that copied internal VPN login pages, registered domains combining the company name with words like support or employee, and obtained valid SSL certificates so the sites looked legitimate. Calls came from VoIP numbers; attackers impersonated IT help desk staff using prior-collected employee dossiers (LinkedIn, public records) to build trust before directing victims to the fake VPN portal to enter credentials, 2FA codes, or one-time passwords. The pattern combined vishing, lookalike domains, and live MFA relay. Defenses: phishing-resistant MFA (FIDO2 hardware keys that cannot be relayed), conditional access policies tied to managed devices, and help desk verification protocols that never ask for credentials by phone.

Share 

[ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fphishing-protection%2Fvpns-under-attack-as-a-result-of-the-increase-in-remote-work%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=VPNs%20Under%20Attack%20as%20a%20Result%20of%20the%20Increase%20in%20Remote%20Work&url=undefined%2Fblog%2Fphishing-protection%2Fvpns-under-attack-as-a-result-of-the-increase-in-remote-work%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fphishing-protection%2Fvpns-under-attack-as-a-result-of-the-increase-in-remote-work%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fphishing-protection%2Fvpns-under-attack-as-a-result-of-the-increase-in-remote-work%2F&title=VPNs%20Under%20Attack%20as%20a%20Result%20of%20the%20Increase%20in%20Remote%20Work "Share on Reddit") [ ](mailto:?subject=VPNs%20Under%20Attack%20as%20a%20Result%20of%20the%20Increase%20in%20Remote%20Work&body=Check out this article: undefined%2Fblog%2Fphishing-protection%2Fvpns-under-attack-as-a-result-of-the-increase-in-remote-work%2F "Share via Email") 

![Attack](https://media.mailhop.org/duocircle/images/2020/09/spf-validator-5308.jpg) 

_The first wave of pandemic-related phishing attacks targeted vulnerable employees and consumers_. There were [attacks](/phishing-protection/it-was-only-a-matter-of-time-before-the-lockdown-lead-to-delivery-based-phishing-scams/#more-19217) that used home delivery services and [attacks](/phishing-protection/the-strange-irony-of-covid-19s-effect-on-certain-phishing-attacks/#more-18685) that used travel-related services. There were [attacks](/phishing-protection/the-always-dangerous-combination-phishing-attack/#more-20113) on spoofed resumes and [attacks](/phishing-protection/why-hackers-have-focused-so-heavily-on-the-us-small-business-administration/#more-21414) on the SBA’s Office of Disaster Assistance. Now hackers have moved on to the gainfully employed by attacking the virtual private networks (VPN) that remote workers use to connect to the office while working remotely.

Both the FBI and the CISA (Cybersecurity and Infrastructure Security Agency) have issued a joint warning about **vishing attacks** on VPNs according to [We Live Security](https://www.welivesecurity.com/2020/08/25/fbi-cisa-warn-spike-vishing-attacks/). It’s a perfect logical target for hackers, as many are first time remote workers, who may not be familiar with using VPNs and the companies they work for may not yet have the proper cyber defenses in place for a distributed workforce.

According to the advisory, “Since around mid-July cybercriminals have been able to steal login details into employee tools at a number of companies. As part of the campaigns, the black hats created **phishing websites** that duplicated or resembled the internal VPN login pages of various companies, obtained Secure Socket Layer (SSL) certificates for their domains and gave them various names that use a combination of the company’s name and hyphen and words such as _support_ or _employee_.”

The interesting thing about these attacks is that they are [vishing attacks](/phishing-protection/top-phishing-email-attacks-worldwide-in-2018/), or voice **phishing attacks**. That means the attack starts with a phone call using a VOIP (voice over IP) phone. _Vishing often plays a major role in social engineering_. In this case “the fraudsters impersonated IT help desk workers and used the information from their dossiers to gain the victims’ trust. From there, the attackers convinced the targets that they would receive a new VPN link that would require their login, including two-factor authentication (2FA) or a one-time password (OTP).”

[![Phishing attack](https://media.mailhop.org/duocircle/images/2020/09/spf-flattening-5398.jpg)](https://media.mailhop.org/duocircle/images/2020/09/spf-flattening-5398.jpg)

This is an important part of the scam. With most VPNs you cannot login without 2FA or OTP so the hackers must set up a **phishing site** to capture these login credentials, which they’ve done.

With a scam this elaborate, _in which the hacker is willing to call you and convince you they’re from the support_, how are employees supposed to protect themselves? The answer is they can’t, but technology can. Technology like [Phishing Protection](/email/phishing-protection) available from DuoCircle.

No matter how sophisticated the ruse, all **phishing attacks** come down to one thing: _getting the victim to click on a link they shouldn’t_, and that’s where **Phishing Protection** comes in. Phishing Protection ignores all the social engineering and slight-of-hand and focuses only on the links and where they point to. And if any link point somewhere dangerous, Phishing Protection keeps you from reaching that site.

How does Phishing Protection do that? It sits between you and all the sites you visit and in essence visits them first to make sure they’re okay. _It can do that because it’s a cloud-based service_. And since it’s cloud-based, it also means there’s no hardware or software to buy and _it sets up in about 10 minutes_.

If you worried about your first-time remote workers and attacks on your VPN, checkout Phishing Protection. _It costs only pennies per employee per month and you can try it **free for 60 days**_.

![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) 

Brad Slavin 

General Manager

General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio.

## Secure your email infrastructure

Protect, authenticate, and deliver. Contact our team to find the right solution.

[Contact Sales](/contact/) [Explore Products](/products/) 

## Related Articles

[  Phishing 11m  AI-Generated Phishing Has Eliminated the Typo: Why Traditional Email Filters Are No Longer Enough  Apr 28, 2026 ](/blog/ai-generated-phishing-eliminates-typos-making-traditional-email-filters-ineffective/)[  Phishing 5m  10 Applications of ChatGPT that Hackers Are Already Exploiting  May 3, 2023 ](/blog/phishing-protection/10-applications-of-chatgpt-that-hackers-are-already-exploiting/)[  Phishing 4m  65% of Global Businesses Ill-Equipped to Defend Against Email-Based Cyber-Attacks  Mar 29, 2016 ](/blog/phishing-protection/65-global-businesses-ill-equipped-defend-email-based-cyber-attacks/)[  Phishing 9m  7 Ways to Protect Your Organization from Email-based Ransomware Attacks  Feb 11, 2018 ](/blog/phishing-protection/7-ways-protect-organization-email-based-ransomware-attacks/)

```json
{"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}
```

```json
[{"@context":"https://schema.org","@type":"BlogPosting","headline":"VPNs Under Attack as a Result of the Increase in Remote Work","description":"The first wave of pandemic-related phishing attacks targeted vulnerable employees and consumers.","url":"https://www.duocircle.com/blog/phishing-protection/vpns-under-attack-as-a-result-of-the-increase-in-remote-work/","datePublished":"2020-09-05T02:51:47.000Z","dateModified":"2025-05-23T17:40:32.000Z","dateCreated":"2020-09-05T02:51:47.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/phishing-protection/vpns-under-attack-as-a-result-of-the-increase-in-remote-work/"},"articleSection":"phishing-protection","keywords":"","wordCount":541,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2020/09/spf-validator-5308.jpg","caption":"Attack","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"Phishing"},{"@type":"ListItem","position":3,"name":"VPNs Under Attack as a Result of the Increase in Remote Work","item":"https://www.duocircle.com/blog/phishing-protection/vpns-under-attack-as-a-result-of-the-increase-in-remote-work/"}]}]
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"Phishing","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"VPNs Under Attack as a Result of the Increase in Remote Work","item":"https://www.duocircle.com/blog/phishing-protection/vpns-under-attack-as-a-result-of-the-increase-in-remote-work/"}]}
```

```json
{"@context":"https://schema.org","@type":"BlogPosting","headline":"VPNs Under Attack as a Result of the Increase in Remote Work","description":"The first wave of pandemic-related phishing attacks targeted vulnerable employees and consumers.","url":"https://www.duocircle.com/blog/phishing-protection/vpns-under-attack-as-a-result-of-the-increase-in-remote-work/","datePublished":"2020-09-05T02:51:47.000Z","dateModified":"2025-05-23T17:40:32.000Z","dateCreated":"2020-09-05T02:51:47.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/phishing-protection/vpns-under-attack-as-a-result-of-the-increase-in-remote-work/"},"articleSection":"phishing-protection","keywords":"","wordCount":541,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2020/09/spf-validator-5308.jpg","caption":"Attack","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}
```