Attackers may obtain phone numbers through various means, including data breaches, online directories, social media, and even purchasing lists from the dark web.