As a result of its discovery, the firm says that its various anti-spam and security systems have been updated to block the new type of phishing attack.
Cloudmark says it has detected two new VoIP-specific attacks this week. As a precaution, it advises against dialing phone numbers received in emails from institutions and to double-check and dial the numbers printed on ATM cards instead.
Adam O'Donnell, the firm's senior research scientist, says that that first attack has been analysed in some detail.
"In these attacks, the target receives an email - ostensibly from their bank - telling them there is an issue with their account and to dial a number to resolve the problem", he notes.
Recipients, he adds, are then connected over a VoIP connection to an interactive voice response system that sounds exactly like their own bank's phone tree, directing them to specific extensions.
"In a VoIP phishing attack, the phone system identifies itself to the target as the financial institution and prompts them to enter account number and PIN", he says, adding that the result can be financially devastating.
According to O’Donnell, traditional content and identity rules based on volume analysis for capturing spam do not work for phishing threats: phishers move quickly, using and breaking down multiple sites to launch the same attack.
VoIP-based services, he says, allow phishers to cheaply add and cancel phone numbers that are harder to trace than conventional numbers.
Cloudmark says that its research servers have now generated the unique fingerprinting algorithms of the attacks, allowing its systems to automatically identify the phone numbers used in VoIP phishing attacks.