An administrator has advised against providing any information over the phone as a way to prevent against which of the following threats?

Session hijacking is a technical attack where an attacker intercepts or steals an authenticated session token to impersonate a user - it does not involve phone calls or information disclosure by the victim.

Social engineering exploits human psychology rather than technical vulnerabilities to obtain sensitive information. Advising employees not to share information over the phone directly counters vishing and pretexting attacks, where an attacker impersonates a trusted party (IT support, bank, etc.) to extract credentials or sensitive data verbally.

Man-in-the-middle attacks intercept network communications between two parties and are a technical network-layer exploit, not a phone-based information disclosure threat.

Shoulder surfing involves physically observing someone's screen or keyboard to steal information - it is a visual eavesdropping technique, not a phone-based threat.