Hedge Funds Targeted by Vishing: Inside the Wave That Hit Citadel, Two Sigma and Point72

On August 5, 2026, several of the world's largest hedge funds were targeted in a coordinated wave of voice phishing. No malware. No zero-day. Attackers picked up the phone and called employees. Vishing is now a campaign-grade initial access technique aimed at the most security-mature firms in finance. Here is what happened, and what to change this quarter.

What happened: vishing fury on hedge funds

According to Bloomberg, threat actors recently launched a coordinated vishing campaign targeting employees at some of Wall Street's largest investment firms. Attackers impersonated trusted contacts over the phone to trick employees into revealing sensitive information or granting system access.

The targets included Citadel, Two Sigma, Point72, Millennium Management, and several private equity firms, some of the world's most security-conscious financial institutions. The attacks demonstrate that even organizations with mature cybersecurity programs remain vulnerable to sophisticated social engineering.

So far, there is no public evidence that the campaign resulted in a successful breach. Two Sigma said it detected and contained the attack with no impact to its systems or data. Point72 also confirmed it was targeted, stating that its initial investigation found no client information had been compromised.

The incident prompted a rapid response from regulators. FINRA alerted member firms to the attempted intrusions through its Financial Intelligence Fusion Center, launched in March 2026 to share threat intelligence and coordinate responses across the financial sector.

Why hedge funds

Concentrated authority:
Small teams move very large sums. One treasury or operations employee can often initiate transfers that would need committee approval elsewhere.

Legitimate urgency culture:
Urgent out-of-band requests from senior staff are routine here. The signal that would raise an alarm elsewhere is business as usual.

Lean help desks with reset authority:
IT support with MFA reset rights is often small or outsourced. One compromised agent yields identity-layer access without touching an endpoint.

The Consequences of the Rising Vishing Threat

This wave of coordinated vishing attacks is the visible end of a trend line that has been steepening for two and a half years.

The CrowdStrike 2026 Threat Hunting Report gives three reasons why vishing keeps growing, and each applies directly to a fund environment.

It bypasses traditional controls. No attachment, no link to rewrite, no binary to flag. Your email security stack has no visibility into a phone call.

It exploits the human factor harder. Live human-to-human interaction is more persuasive than an email. Attackers typically impersonate IT staff, citing a trivial support issue as pretext.

It leaves almost nothing behind. Vishing produces far fewer forensic artifacts than phishing or smishing, making post-incident investigation materially harder.

Voice synthesis removes the operator-hours constraint that has capped this technique so far. The curve above is the pre-AI baseline.

The chain to plan against

1. Vishing call lures the target to an adversary-in-the-middle page, usually on a personal unmanaged device chosen because it sits outside security visibility.
2. Credentials and MFA response are captured.
3. The adversary authenticates through a residential proxy matching the user's geolocation.
4. The adversary enrolls their own MFA device for persistence.
5. Direct SaaS access follows. No malware, no lateral movement, no privilege escalation.

In one February 2026 case, hunters detected the activity four minutes after the call and the customer evicted the adversary within twenty. That is your response window.

What financial services firms should do now

A vishing call in isolation cannot be detected by enterprise tooling. The controls that work are procedural and behavioral.

Callback is the control that matters most. An attacker can clone a voice, spoof caller ID, and hold a fluent conversation under pressure. They cannot answer the number already on file.

Training is the other half. Staff who have already taken a convincing simulated vishing call recognize the real one faster, because recognition comes from exposure, not instruction.

Our full defensive blueprint covers the 30-60-90 day rollout, role-by-role targeting, and realistic susceptibility benchmarks for finance populations.

Read the CISO playbook: AI vishing attacks and how to defend finance teams →

Test and train on real and current attack patterns

After a publicly reported sector-wide campaign, the investment committee will not ask whether you run training. It will ask whether the targeted population was tested against this specific technique, and what the results were.

Most awareness programs run on latency. A technique appears in the wild, hits the press, and enters the training calendar six to twelve months later. Employees train on last year's attacks. Arsen turns emerging social engineering attacks into hands-on training within 30 days, before they reach your workforce.