home » the workshop » Vixxing
Security tooling
NEW!Vixxing
Caller verification for IT help desks. Before anyone resets a password or MFA, the caller reads a live 6-digit TOTP code off their phone. Facts leak. Possession doesn’t.
- access:
- public
- year:
- 2026
- built with:
- Django, PyOTP, TOTP, Microsoft Graph
Most account-takeover defenses assume the attack comes through a login screen. The help desk is a different door, and usually a weaker one. An attacker looks up an employee, calls in sounding legitimate (“I got a new phone and I’m locked out”), and talks an agent into resetting MFA. Every check the agent can run, from caller ID to employee ID to date of birth, only proves the caller knows facts. Facts leak.
Vixxing puts a possession factor on the phone call itself. Every employee enrolls a TOTP secret, the same RFC 6238 one-time-password standard their authenticator app already uses for login. When they call, the agent asks for the current 6-digit code, types it in, and gets a green Caller Verified or a red Do not proceed. Someone without the enrolled phone can’t pass, no matter how much they know about the person they’re pretending to be.
The name is a nod to the problem: vishing, or voice phishing.
~ highlights ~
- One staff-facing dashboard to add employees, verify callers, search, and import or export CSV
- Enrollment by email: the server generates a secret, renders it as a QR code and sends it through Microsoft Graph
- Works with Microsoft Authenticator, Google Authenticator and any other TOTP app
- Accepts the current 30-second window plus one on either side to allow for clock drift