Scattered Spider and the help desk: social engineering the identity reset

What happened

The group known as Scattered Spider ran a series of high-profile intrusions, including the 2023 attacks on MGM Resorts and Caesars Entertainment. A signature technique was calling the IT help desk, impersonating an employee, and persuading an agent to reset the target's password or enroll a new MFA device. With the reset done, the attacker held legitimate, fully authenticated access.

Root cause

Help-desk identity verification was weak. Agents reset credentials and MFA based on information an attacker could research or phish (employee ID, manager name, basic personal details). The recovery and enrollment path, not the login, was the soft spot.

The identity lesson

Attackers target the weakest step in the identity lifecycle, and that is usually account recovery and MFA enrollment, not primary authentication. Strong login does not help if anyone who sounds convincing can have credentials reset over the phone.

How to defend

Harden help-desk verification: require strong, hard-to-phish proof of identity before any reset, such as a manager approval or an in-person or video check for sensitive roles.
Use phishing-resistant MFA and make re-enrollment a high-assurance event, not a casual one.
Limit who can perform resets, log and alert on them, and add a delay or secondary approval for privileged accounts.
Watch for the pattern: reset followed immediately by login from a new device or location (ITDR).

The pattern in 2026

Help desk social engineering did not fade, it industrialized. The August 2026 McKesson breach ran the same play: attackers registered the lookalike domain mckesson[.]claims, called multiple employees while impersonating help desk and IT staff, took Okta credentials, and used the resulting single sign-on session to reach Salesforce and Snowflake, exfiltrating roughly a terabyte over four days.

The consumer version is now automated. SOCRadar documented AnonyMousKIT in August 2026, a phishing platform renting a commercial AI voice agent to call Apple device theft victims as "Alice from Apple Support" in three languages, asking for the device passcode, Apple ID, and a live two-factor code, at about ten cents per call. The rate limit on voice phishing used to be human operators who spoke the target's language. It is gone.

What actually closes this

The controls that work are procedural, and they are unpopular because they add friction to the exact moment someone is locked out and frustrated:

Verification that does not use caller-supplied facts. Employee ID, manager name, and date of birth are all researchable. Use a callback to a number of record, a video check against a stored photo for privileged roles, or approval from a manager through a separate channel.
Make re-enrolment a high-assurance event. Resetting a phishing-resistant factor should be harder than using it.
Add friction proportional to privilege. A delay plus secondary approval for administrators costs an hour once and prevents a domain compromise.
Alert on the sequence, not the event. Reset followed by sign-in from a new device within minutes is the signature, and it is detectable.
Reduce what a reset is worth. If the account has no standing privilege, a successful reset yields far less. See zero standing privileges.

Vendors: ITDR, MFA, PAM. Glossary: account takeover, phishing-resistant MFA.