Phishing panel invoking Vapi.ai AI call API with C2 webhook callback

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•3

This rule detects interaction between an internal host and the Vapi.ai API, typically used for automating AI-based voice phishing (vishing) calls. It identifies the initiation of a call via POST requests to the Vapi.ai API and subsequent callbacks from Vapi.ai to an attacker-controlled webhook endpoint used for tracking call status.