Court filings describe those calls as the start of a Scattered Spider intrusion that led to an extortion demand of about $8 million. The Justice Department has since charged an alleged member of the group, a 19-year-old man who was arrested in Finland and extradited to the United States in June. Prosecutors attribute more than 100 network intrusionsOpens a new window <\/a> and over $100 million in ransom payments to the crew.<\/p>\n READ MORE: Anyone who resets credentials based on a convincing phone call is exposed the same way, whether that\u2019s your team or the managed provider that answers your tickets after hours. And, given some attackers are even able to fake a person\u2019s voice<\/a> over the phone, you can\u2019t always be sure that Bob from Accounting is actually calling your help desk with that urgent request.<\/p>\n Here\u2019s a look at how these scams typically play out and what you can do to stop them in their tracks.\u00a0<\/p>\n How attackers talk a help desk into a password reset<\/p>\n CISA\u2019s joint advisory on Scattered SpiderOpens a new window <\/a> describes how the attack works. The caller only needs a name, a story, and\u00a0 whoever answers the phone is willing to reset the password and transfer MFA upon request. The impersonation runs in both directions, too. CISA also documents callers who claim to be IT staff and talk end users out of their one-time passcodes.<\/p>\n According to the advisory, the first conversations in this scam are often just recon. Bad actors phone ahead to learn what a reset requires at that particular company, and then they come back with every answer rehearsed. They do their homework on the people, too, pulling names, roles, and personal details from social media and open sources. By the time the actual request comes in, it sounds like one of your colleagues in a hurry. Generative AI keeps making the pretense harder to spot<\/a>.<\/p>\n In its 2026 Global Threat Report, CrowdStrike says Scattered Spider got into cloud and single sign-on accounts last year almost exclusively by sweet-talking help desk personnel into granting self-service password resets. In one intrusion the firm reconstructed, the group went from initial access to a working copy of the victim\u2019s entire Active Directory credential store within three hoursOpens a new window <\/a>. Every step in between came from a valid account doing routine work, so monitoring tools had little to flag.<\/p>\n Verizon\u2019s analysts file these calls under pretexting in the 2026 Data Breach Investigations Report. They also record a substantial increase in attackers pretending to be help desk agentsOpens a new window <\/a> or users who need a reset. In the report\u2019s simulation data, phone- and text-based lures drew a 40% higher median click rate than email phishing campaigns.<\/p>\n READ MORE: A fraudulent reset won\u2019t trip any of your usual alarms because every step uses a legitimate account coming through the front door. Once your desk enrolls the caller\u2019s new phone, the attacker\u2019s logins will clear your MFA checks like any employee\u2019s. Nothing will fail, so no alert will ever fire. From the identity provider\u2019s perspective, a real employee picked up a new device. This attack can still be stopped in one place, though\u2014the conversation at the desk.<\/p>\n Verify a caller\u2019s identity before you reset a password<\/p>\n After a wave of intrusions hit U.K. retailers in 2025, the National Cyber Security Centre urged organizations to review how the help desk authenticatesOpens a new window <\/a> a caller before resetting credentials, especially on accounts with elevated privileges. The agency\u2019s advice ranged from comprehensive MFA coverage to watching for risky logins.<\/p>\n The NCSC also warns that attacks like these are growing more common for companies of every size. Microsoft, which tracks the group as Octo Tempest, flags helpdesk-linked accounts as priority targetsOpens a new window <\/a> for precisely this reason.<\/p>\n You can close off much of the risk with a few targeted process improvements:<\/p>\n Verify on a separate channel. Don\u2019t reset anything on an inbound request alone. The help desk ends the conversation and calls the employee back at the number your HR system already has on file, never one the requester supplies.<\/p>\n Step up for sensitive resets. A password change is one thing. Re-enrolling MFA or touching one of your administrator accounts requires stronger proof, such as a manager\u2019s sign-off or an in-person check. Microsoft\u2019s hardening guidance puts admins on phishing-resistant MFA first, an upgrade you can make without an enterprise identity budget<\/a>.<\/p>\n Write the MSP into the plan. If a managed provider answers your tickets, its verification procedure is effectively yours. CISA\u2019s advisory names contracted IT help desks among the group\u2019s targets, so ask the provider to walk you through its reset protocol. If what you hear is looser than the checks above, push for the stricter version and get whatever you agree on into your contract.<\/p>\n Make it safe to say no. Most help desks get graded on speed, of course, and these cybercriminals lean on that pressure. Give your techs standing permission to refuse and escalate when a request feels off, embracing the same no-shame reporting culture<\/a> that gets your users to flag phishing early.<\/p>\n Together, these steps make the help desk a dead end for anyone who isn\u2019t who they say they are\u2014and they don\u2019t add much of a delay for an employee who\u2019s genuinely locked out.<\/p>\n Add the help desk to your security awareness training<\/p>\n In SANS\u2019 2026 security awareness report, 77% of respondents named social engineeringOpens a new window <\/a> their top human risk, noting that voice and text phishing are growing in volume and sophistication. Most training attention goes to the inbox, even as AI is rewriting what phishing looks like<\/a> there anyway. This reset scam arrives by phone and comes for the handful of people with the power to change credentials\u2014your most consequential audience, and probably your smallest.<\/p>\n If you haven\u2019t yet incorporated this relatively new scam into your security training, now is an excellent time to teach your users how to spot these attacks in the wild (including the scenario in which they come from people claiming to be on your IT team).\u00a0<\/p>\n While you\u2019re at it, it might not be a bad idea to set up a drill for your help desk team to get some practice on how to handle this sort of thing. Consider staging a mock reset request from a caller armed with a real name, a plausible issue, and no patience for your procedure. This way, you\u2019ll be able to take care of legitimate reset requests without accidentally granting an attacker the keys to the kingdom.<\/p>\n Categories: Articles<\/a>, Security<\/a><\/p>\n Your Essential Daily Tech Brief<\/p>\n Sign up for the Spiceworks Newsletter and stay ahead with a curated mix of expert advice, technical tips, and the trending discussions your peers are having right now.<\/p>\n \n \uf00c\n <\/p>\n \n \uf071\n <\/p>\n \t\t \t\t\t\tFormer IT Director turned tech writer, Rose de Fremery built an IT department from scratch; she led it through years of head-spinning digital transformation at an international human rights organization. Rose creates content for major tech brands and is delighted to return to the Spiceworks community that once supported her own IT career.<\/p>\n","protected":false},"excerpt":{"rendered":"Password resets used to be among the most boring and straightforward requests help desks received on a regular…\n","protected":false},"author":2,"featured_media":666134,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[282181,61,60,80],"class_list":["post-666133","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-help-desk-password-reset-attacks","tag-ie","tag-ireland","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/666133","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/comments?post=666133"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/666133\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media\/666134"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media?parent=666133"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/categories?post=666133"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/tags?post=666133"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n Why AI Office clones won’t replace Microsoft 365 yet<\/a><\/p>\n
\n IT Job Watch: Risk and compliance cybersecurity specialist<\/a><\/p>\n![\"img](\"https:\/\/www.newsbeep.com\/ie\/wp-content\/uploads\/2026\/10\/img-loading-circle-1-final.gif\")
<\/p>\n![\"Rose](\"https:\/\/www.spiceworks.com\/wp-content\/uploads\/sites\/3\/0f\/f7\/fed00201439e903b0d0d6185b1da\/rose-de-fremery.jpg?w=96\")
<\/p>\n