AI Vishing Kits Now Run the Whole Call Without a Human

A criminal phishing kit called Balonx Sistema now places voice phishing calls that are conducted entirely by AI. A large language model writes the dialogue, a synthetic voice speaks it, and speech recognition transcribes the victim's replies and feeds them back in, so the conversation adapts in real time with no person on the line. Group-IB, which uncovered the kit, calls its AI calling module a fundamental evolution in phishing-as-a-service, because it removes the one thing that has historically capped how many vishing calls a criminal operation could make: people to make them.

This article explains what the researchers found, how an automated vishing call actually works, and what it changes for organizations that already defend against phone-based social engineering.

What Group-IB found

Group-IB published its analysis of Balonx Sistema on August 19, 2026. According to the report, Balonx is a phishing-as-a-service platform run by an operator based in Mexico and rented to other criminals on a weekly subscription. It targets more than 20 financial institutions in Mexico, and the researchers state that credentials and financial information from more than 1,100 users have been harvested since at least October 2025.

The platform works like a legitimate software business. There are two subscription tiers: an Individual Plan at 3,000 MXN per week for up to two devices, and an Office Plan at 6,000 MXN per week that supports up to eight sub-accounts. New affiliates sign up through a Telegram bot, and the service was promoted openly in Facebook groups popular with telemarketing fraud circles.

Researchers gained unusual visibility into the operation because of a security failure on the criminals' side: leaked GitHub repositories exposed the platform's code, infrastructure and affiliate network.

Balonx bundles several capabilities that are each dangerous on their own:

• Live control of the victim's phishing session over a persistent WebSocket connection, with 14 distinct fake screens the operator can push to the victim at any moment.
• Interception of one-time codes, including SMS verification codes and transaction authorization codes, relayed to the real banking portal before they expire.
• An Android remote access trojan based on Spyroid, delivered through a fake "bank protection" app prompt.
• CallFlow, a separate AI vishing module designed to replace human call-center operators entirely.

CallFlow is the part that matters most for anyone who trains people to recognize phone-based attacks.

How an AI vishing call works, step by step

Group-IB reports that CallFlow combines four commercial AI services into one telephony fraud pipeline:

• OpenAI GPT-4o-mini: Generates the dialogue in real time during the call
• ElevenLabs (a voice profile named "Carolina"): Produces the synthetic voice the victim hears
• OpenAI Voice ("echo"): Fallback or alternative voice
• OpenAI Whisper: Transcribes the victim's speech in real time

In practice a call runs as a loop. The system dials the victim and speaks as a fabricated bank representative. The victim answers. Whisper converts that answer to text within the call. The language model reads the transcript and writes the next line. The synthetic voice speaks it. The loop repeats until the call ends.

Nothing in that loop needs a person. According to the report, the calling infrastructure runs on FreePBX and supports 30 concurrent call channels by default, with multi-trunk and multi-campaign configurations. Group-IB's assessment is that this design enables a single operator to run hundreds of simultaneous fraudulent calls without any human involvement in the conversation.

The researchers also describe the result from the victim's side: they state that the interaction is indistinguishable from a human call-center operator to most victims.

A human is still available when needed. The CallFlow administration panel shows active calls, daily call volume, success rates, calls in queue and average call duration, and managers can listen to live calls covertly. The AI handles volume; a person can step in when a call goes off script.

Why this changes the economics of vishing

For years, vishing has been expensive to run at scale. Each call needed a person who could sound credible, follow a script, handle objections and improvise when the victim pushed back. That cost limited how many people a fraud operation could reach, which is part of why email phishing, which can be sent to thousands at almost no marginal cost, has dominated by volume.

Group-IB states the shift directly: vishing attacks have historically been limited by the availability of human operators, and CallFlow eliminates that constraint. When the cost of an additional call approaches zero, the calculation that kept vishing a targeted, lower-volume attack no longer holds.

Two consequences follow for defenders.

Volume goes up, and quality does not go down. A tired or inexperienced human caller gives themselves away. A language model working from a script does not get tired, does not lose its temper and does not forget the story. The researchers expect financial institutions to face vishing attacks of unprecedented scale and linguistic quality as this architecture spreads through criminal networks.

Language stops being a barrier. Human vishing operations are limited to the languages their callers speak fluently. Synthetic voice and language models remove that limit. This is our assessment rather than a finding in the report, but it follows from the components the report lists.

Where the verification code actually gets stolen

It is easy to read coverage of this kit and assume the AI voice talks the victim into reading out a one-time code. The report describes something more precise, and more useful for defenders to understand.

The code interception happens in the kit's web phishing module. When a victim enters banking credentials on a fake page, the operator relays them to the real banking portal, receives the multi-factor authentication challenge, and immediately pushes a screen asking the victim for the same code. The code reaches the attacker before it expires.

The vishing and web modules are coordinated, with operator contact details embedded to link the two. A phone call can build urgency and trust, and the fake page can collect the code. That combination is what makes the attack effective, and it is why defending against only one channel leaves a gap.

What this means for organizations outside banking

Balonx targets retail banking customers in Mexico. It is not an attack on corporate employees today, and the researchers do not describe it as one.

The architecture, however, is not specific to banks. A pipeline that holds a convincing, adaptive phone conversation and hands the victim to a fake page to capture a code could impersonate an IT help desk, a payroll provider or an executive assistant just as easily as a bank representative. Group-IB writes that as this architecture matures and spreads through criminal networks, financial institutions will face vishing attacks of unprecedented scale. The same pressure would reach any organization whose people can be called. That is the reason it belongs on the radar of any security team responsible for employees, not only for fraud teams at financial institutions.

The data on phone-based attacks already points the same way. In the 2026 Verizon Data Breach Investigations Report, the median click rate for email phishing simulations was around 1.4%, while phone-based simulations failed at around 2%, roughly 40% higher than email.

Source: Verizon 2026 Data Breach Investigations Report, p. 50.

Preparation for AI-generated voices is also lagging. 35% of organizations have experienced a deepfake incident, while only 10% of security leaders prioritize deepfake training.

Source: Gartner, "6 Ways to Transform Your Cybersecurity Awareness Program" (G00840741, March 2026), 2025 Secure Behavior Strategies Survey (n=65).

How to defend against automated vishing

None of the defenses below depend on detecting that a voice is synthetic. That matters, because the researchers state that most victims cannot tell the difference. The reliable defenses change what a caller is able to get, not how well people judge a voice.

1. Make call-back verification a rule, not a judgment call. Group-IB's first recommendation to end users is to hang up and call back using a number from an independent source, such as the number printed on a bank card. Inside an organization, the equivalent is a published rule: no password reset, payment change or access request is completed on an inbound call. The employee ends the call and calls back through the directory. A synthetic voice cannot pass a check it is never given the chance to answer.

2. Move high-value accounts off SMS codes. The researchers recommend moving to FIDO2 and hardware security keys, which resist the real-time relay technique Balonx uses. They also note that biometric authentication and hardware keys are significantly harder for real-time phishing infrastructure to intercept than SMS one-time codes. For finance, IT administration and executive accounts, this removes the prize the attack is built to collect.

3. Never install an app because a caller asked. Balonx delivers its Android trojan through a fake security app prompt. Group-IB's guidance is to never install an application suggested by a phone call or a website outside the official app stores. For employees, the rule is simpler still: legitimate IT teams do not ask people to install software during an unsolicited call.

4. Treat voice and web as one attack. Because the phone call and the fake page work together, a program that trains people to spot suspicious links but never exposes them to a convincing phone call covers half the attack. Read our guide to vishing, smishing and phishing for how the channels combine.

5. Give people a fast way to report a suspicious call. Early reports are what let a security team spot a campaign while it is still running. If reporting a call is harder than reporting an email, many suspicious calls will go unreported.

Training people for a caller who does not get tired

Awareness training built around spotting a nervous caller or a scripted mistake is now training for the wrong attacker. The practical goal is a reflex that does not depend on the quality of the voice: when a call asks for a code, a credential, a payment or a software install, the employee ends the call and verifies independently, however natural the caller sounds.

That reflex is built the same way as any other: realistic practice, repeated, with feedback at the moment of failure. Two-way AI voice simulations let employees rehearse exactly this situation, a fluent caller who answers their questions and pushes back, before a real one reaches them. Our step-by-step guide to running a voice phishing simulation covers scope, consent and reporting, and real examples of vishing scams show the scripts attackers use.

Keepnet's Vishing Simulator runs two-way AI voice calls in the employee's own language and connects each result to targeted training. For the related attack where the victim is tricked into calling the attacker, see the Callback Phishing Simulator. To compare the options on the market, see the best vishing simulation tools.

Sources

• Group-IB, "Balonx Sistema: The Face Behind the PhaaS Affecting Mexican Banking," August 19, 2026. All findings about Balonx Sistema and the CallFlow module in this article come from this report.
• Verizon, 2026 Data Breach Investigations Report, p. 50.
• Gartner, "6 Ways to Transform Your Cybersecurity Awareness Program" (G00840741, March 2026), 2025 Secure Behavior Strategies Survey (n=65).