Social Engineering at the Help Desk
A convincing phone call can be enough to open a path straight into a company network. According to findings published by cybersecurity researchers at Flare, including Jon DiMaggio, the threat group known as Scattered Spider has repeatedly used social engineering to persuade corporate help desk workers to reset passwords or move multi-factor authentication tokens to a device controlled by an attacker. Under the hood, this approach turns routine account recovery into a serious security risk by exploiting the very support process designed to help genuine employees regain access.
The technical reality is that the attackers rarely need to break the security technology directly. Instead, operators pose as workers who have lost a phone, changed numbers, or been locked out before an important meeting. Personal details gathered from public professional profiles, company websites, and breached data make the support calls sound entirely genuine. As ever, the detail that matters is that if a support agent accepts those details as proof of identity, the caller gains access to the target account and subsequent company services.
Bypassing Identity Controls Without Software Exploits
Multi-factor authentication normally asks users to prove their identity in more than one way, such as using a password alongside a phone prompt. However, if an attacker persuades a help desk to register a new authentication device, they can pass the next login check as if they were the real employee. Flare describes this method as a people-centred route into enterprise identity systems, rather than a campaign that depends on a new software flaw. The group is also known by alternative names including UNC3944 and Octo Tempest, while security agencies track related activity under different labels.
Once inside, a successful account reset can give attackers access to email, single sign-on portals, virtual private networks, and cloud services. This tactic has appeared alongside other pressure methods documented by CISA and its partners, such as MFA fatigue, where attackers send repeated login prompts to tire out a distracted employee, and SIM-swap attacks targeting phone verification codes. A successful account takeover provides a foothold for further activity, allowing actors to seek higher privileges, create ways to retain access, or deploy legitimate remote-management tools that blend in with normal IT work. In some cases, access is followed by data theft, extortion, or ransomware deployment.
Attribution Challenges and Recommended Defenses
Security researchers warn that a help desk call alone does not prove that Scattered Spider carried out an incident, because help desk vishing is now used by actors across a wider cybercrime ecosystem. Investigators need to assess the full picture, including technical evidence, infrastructure, and other behavior, before confirming attribution. That caution matters for companies reporting incidents and for readers assessing claims made by threat actors.
To defend against these tactics, CISA recommends deploying phishing-resistant multi-factor authentication, including FIDO, WebAuthn, or public-key-based methods. Treating identity recovery as part of the core security boundary rather than a routine service task helps organizations prevent attackers from turning human helpfulness into a network breach.
Sources
- Scattered Spider Hackers Exploit Help Desk Calls to Bypass MFA and Breach Corporate Networks
- Breach Roundup: French Supermarket Hacks a 'Wake-Up Call'
Photo: Julian Hochgesang / Unsplash (Unsplash License)
