Help-desk vishing: the call that breaches a company

The loudest breaches of 2026 didn’t start with an exploit or a malicious attachment. They started with a phone call. The attacker calls the internal IT help desk, poses as an employee who “lost their phone and can’t log in,” and politely asks to reset MFA or enrol a new device. A few minutes later they have valid access to company systems — without cracking a single password. This scenario, associated with groups such as Scattered Spider and ShinyHunters, became in 2026 one of the most effective ways to take over an organisation.

Why it works

Companies spent years investing in technology: MFA, EDR, email filtering. Attackers did the rational thing — they bypassed the technology and targeted the process and the human. A help desk is, by definition, geared toward helping and quickly unblocking people, often under time pressure and an “important” caller. Those are ideal conditions for manipulation.

An MFA reset or new-device registration is, in practice, handing over the keys: the attacker takes control of the second factor, and then the password (often already phished or bought) is enough to log in. According to the EU agency ENISA, the vast majority of modern social engineering is now assisted by AI tools — from polished call scripts to synthetic voice — which makes such calls even harder to spot.

What the full chain looks like

The call itself is only the beginning. A typical flow in 2026 campaigns:

1. Reconnaissance. The attacker gathers names, roles and org structure from public sources to sound credible on the call (a manager’s name, a department, internal jargon).
2. The help-desk call. They impersonate an employee and force an MFA reset or the addition of a new device. Sometimes they call the other way — posing as the help desk to the employee — to get them to approve a login.
3. Into the identity. With the hijacked account they log in to the identity provider (e.g. the SSO platform), which opens access to many applications at once.
4. Lateral movement and data theft. The attacker reaches for data in SaaS apps — in the high-profile 2026 cases this meant mass exfiltration from CRM platforms, followed by extortion: threatening to publish the stolen records unless the victim pays.

In the background operate loosely linked groups — Scattered Spider, ShinyHunters and others, described collectively as “Scattered Lapsus$ Hunters.” Despite arrests of some lower-ranking members, the campaigns kept returning, and operators launched leak sites to increase pressure. We described this scene’s “target the store” technique in Scattered Spider’s retail attacks; here the same style hits the help desk and identity.

How to defend — process, not just technology

Set a hard identity-verification procedure at the help desk. MFA reset and new-device registration are high-risk operations — they must require strong verification. A callback to the number from the HR system (not the one the caller gave), confirmation via a manager, video verification with an ID, or a code from a trusted channel. A voice on the phone can never be enough on its own.

Deploy phishing-resistant MFA. Passkeys / FIDO2 keys are far harder to bypass than SMS codes or a plain “approve login.” Where a push notification remains, enable number matching to make mindless “approve” tapping harder. More in our pieces on rolling out MFA and passkeys.

Limit help-desk privileges. Not every operator needs to be able to reset MFA for any user. Introduce approval thresholds, a separate path for privileged accounts, and full logging of such operations.

Monitor identity and connected apps. Alert on unusual device registrations, logins from new locations, and sudden privilege grants. Review the apps connected via OAuth to your SaaS — it’s the same family of risk we covered in OAuth token theft.

Train the help desk and staff on vishing. Classic anti-phishing training teaches people to scrutinise email; here the attack arrives by voice. The support team must have the right to say “I need to verify” even to the “CEO” and not yield to urgency pressure. It extends what we write about in recognising phishing attacks.

Frequently asked questions (FAQ)

We have MFA — does that protect us? Only partly. This attack doesn’t break MFA; it hijacks it procedurally, getting the help desk to reset it or the user to approve it. Phishing-resistant MFA (passkeys/FIDO2) and hard identity verification at the help desk are the conditions without which “MFA is on” isn’t enough.

We’re a small company — does this affect us? Yes. Although the loudest victims are big brands, the technique is cheap and universal. A smaller organisation can be an easier target, because help-desk procedures are less formalised and staff know one another “by first name,” which lowers vigilance.

The attacker knows internal details — how is that possible? From reconnaissance: names, roles and org structure are often public. Knowing such details doesn’t confirm the caller’s identity — which is exactly why verification must rely on something the attacker doesn’t have (e.g. a callback to a system number, a manager’s confirmation), not on what they “know.”

How do we check whether our help desk is resilient? A controlled social-engineering test (with consent and a defined scope) shows whether an MFA reset can be forced by phone. Get in touch if you want to verify the resilience of the process before an attacker does.

Summary

The most effective attack of 2026 needed no exploit — it needed a phone call and a moment of inattention at the help desk. Defence is within reach of every organisation, but it lies in the process: hard identity verification on resets, phishing-resistant MFA, limited support privileges and identity monitoring. If you want to see whether your help desk would withstand such a call — let’s test it together.

---

Sources and further reading: BleepingComputer, ENISA Threat Landscape, CISA — Scattered Spider advisory.