Breaking into an on-premises or hosted phone system to place unauthorized calls, eavesdrop, or use it as a launch point for other fraud.
IP PBXs are attractive targets because they are connected to the internet and to paid voice trunks at the same time. Attackers scan for SIP services, then try default or weak extension passwords, exploit unpatched web management interfaces, or abuse features such as remote call forwarding and direct inward system access.
A compromised PBX can be used to pump traffic to revenue share numbers, relay robocalls, or forward calls in ways that disguise their origin. Because the traffic comes from a legitimate customer's trunk, it may carry that customer's normal caller ID and attestation, making it harder for downstream networks to identify as fraud.
Basic hygiene goes a long way: strong unique credentials, restricting SIP registration to known addresses, disabling unused features, keeping software patched, and limiting outbound dialing to the destinations the business actually needs. Providers can reinforce these practices by publishing security baselines for customers and by flagging PBXs that register from unexpected locations or retry passwords repeatedly.
Why it matters to carriers
When a customer's PBX is hacked, the fraudulent traffic flows through your trunks and onto your bill with your carriers. Providers that monitor for registration brute-force attempts, sudden changes in destination mix, and calls outside business hours can cut off an attack in minutes and avoid a painful dispute over who pays.