Attackers are calling your help desk to reset their way in

Password resets used to be among the most boring and straightforward requests help desks received on a regular basis. Not anymore.

In May 2025, a series of calls came in to the IT help desk at a luxury jewelry retailer. Each caller claimed to be an employee who needed a password reset and a new device enrolled for multifactor authentication (MFA). The help desk, assuming the requests were legitimate, approved them. According to the federal criminal complaint that followed, the callers compromised three user accountsOpens a new window in roughly two to three hours. Two of them belonged to IT administrators (ouch).

Court filings describe those calls as the start of a Scattered Spider intrusion that led to an extortion demand of about $8 million. The Justice Department has since charged an alleged member of the group, a 19-year-old man who was arrested in Finland and extradited to the United States in June. Prosecutors attribute more than 100 network intrusionsOpens a new window and over $100 million in ransom payments to the crew.

Anyone who resets credentials based on a convincing phone call is exposed the same way, whether that’s your team or the managed provider that answers your tickets after hours. And, given some attackers are even able to fake a person’s voice over the phone, you can’t always be sure that Bob from Accounting is actually calling your help desk with that urgent request.

Here’s a look at how these scams typically play out and what you can do to stop them in their tracks.

How attackers talk a help desk into a password reset

CISA’s joint advisory on Scattered SpiderOpens a new window describes how the attack works. The caller only needs a name, a story, and whoever answers the phone is willing to reset the password and transfer MFA upon request. The impersonation runs in both directions, too. CISA also documents callers who claim to be IT staff and talk end users out of their one-time passcodes.

According to the advisory, the first conversations in this scam are often just recon. Bad actors phone ahead to learn what a reset requires at that particular company, and then they come back with every answer rehearsed. They do their homework on the people, too, pulling names, roles, and personal details from social media and open sources. By the time the actual request comes in, it sounds like one of your colleagues in a hurry. Generative AI keeps making the pretense harder to spot.

In its 2026 Global Threat Report, CrowdStrike says Scattered Spider got into cloud and single sign-on accounts last year almost exclusively by sweet-talking help desk personnel into granting self-service password resets. In one intrusion the firm reconstructed, the group went from initial access to a working copy of the victim’s entire Active Directory credential store within three hoursOpens a new window . Every step in between came from a valid account doing routine work, so monitoring tools had little to flag.

Verizon’s analysts file these calls under pretexting in the 2026 Data Breach Investigations Report. They also record a substantial increase in attackers pretending to be help desk agentsOpens a new window or users who need a reset. In the report’s simulation data, phone- and text-based lures drew a 40% higher median click rate than email phishing campaigns.

A fraudulent reset won’t trip any of your usual alarms because every step uses a legitimate account coming through the front door. Once your desk enrolls the caller’s new phone, the attacker’s logins will clear your MFA checks like any employee’s. Nothing will fail, so no alert will ever fire. From the identity provider’s perspective, a real employee picked up a new device. This attack can still be stopped in one place, though—the conversation at the desk.

Verify a caller’s identity before you reset a password

After a wave of intrusions hit U.K. retailers in 2025, the National Cyber Security Centre urged organizations to review how the help desk authenticatesOpens a new window a caller before resetting credentials, especially on accounts with elevated privileges. The agency’s advice ranged from comprehensive MFA coverage to watching for risky logins.

The NCSC also warns that attacks like these are growing more common for companies of every size. Microsoft, which tracks the group as Octo Tempest, flags helpdesk-linked accounts as priority targetsOpens a new window for precisely this reason.

You can close off much of the risk with a few targeted process improvements:

Verify on a separate channel. Don’t reset anything on an inbound request alone. The help desk ends the conversation and calls the employee back at the number your HR system already has on file, never one the requester supplies.

Step up for sensitive resets. A password change is one thing. Re-enrolling MFA or touching one of your administrator accounts requires stronger proof, such as a manager’s sign-off or an in-person check. Microsoft’s hardening guidance puts admins on phishing-resistant MFA first, an upgrade you can make without an enterprise identity budget.

Write the MSP into the plan. If a managed provider answers your tickets, its verification procedure is effectively yours. CISA’s advisory names contracted IT help desks among the group’s targets, so ask the provider to walk you through its reset protocol. If what you hear is looser than the checks above, push for the stricter version and get whatever you agree on into your contract.

Make it safe to say no. Most help desks get graded on speed, of course, and these cybercriminals lean on that pressure. Give your techs standing permission to refuse and escalate when a request feels off, embracing the same no-shame reporting culture that gets your users to flag phishing early.

Together, these steps make the help desk a dead end for anyone who isn’t who they say they are—and they don’t add much of a delay for an employee who’s genuinely locked out.

Add the help desk to your security awareness training

In SANS’ 2026 security awareness report, 77% of respondents named social engineeringOpens a new window their top human risk, noting that voice and text phishing are growing in volume and sophistication. Most training attention goes to the inbox, even as AI is rewriting what phishing looks like there anyway. This reset scam arrives by phone and comes for the handful of people with the power to change credentials—your most consequential audience, and probably your smallest.

If you haven’t yet incorporated this relatively new scam into your security training, now is an excellent time to teach your users how to spot these attacks in the wild (including the scenario in which they come from people claiming to be on your IT team).

While you’re at it, it might not be a bad idea to set up a drill for your help desk team to get some practice on how to handle this sort of thing. Consider staging a mock reset request from a caller armed with a real name, a plausible issue, and no patience for your procedure. This way, you’ll be able to take care of legitimate reset requests without accidentally granting an attacker the keys to the kingdom.

Categories: Articles, Security

Your Essential Daily Tech Brief

Sign up for the Spiceworks Newsletter and stay ahead with a curated mix of expert advice, technical tips, and the trending discussions your peers are having right now.





Former IT Director turned tech writer, Rose de Fremery built an IT department from scratch; she led it through years of head-spinning digital transformation at an international human rights organization. Rose creates content for major tech brands and is delighted to return to the Spiceworks community that once supported her own IT career.

Tags: