Attackers ring the help desk, pose as an employee and ask for a password reset or an MFA move to a new device. Defend by making identity proof independent of what the caller knows, requiring a callback to a number on file, and putting extra approval on privileged accounts.
What the advisory says happens
CISA's advisory on Scattered Spider, last revised in July 2025, describes several help desk related tactics. Actors pose as IT or help desk staff by phone or SMS to get credentials, and they trick employees into installing remote access tools. Since July 2025 the advisory also describes actors posing as employees to get help desk staff to reset passwords and move MFA to devices the attackers control.
It also describes multi-call campaigns that first gather password-reset procedures and employee details, then pressure the help desk. The first calls may look harmless. They are research.
Why knowledge based checks fail
Employee ID, manager name, date of birth and office location are often easy to find or guess. If the help desk script relies on them, the attacker only needs patience. Treat what the caller knows as weak evidence.
Controls to build
Verify through a channel you control. Call back on the number in the HR system, or send a prompt to a device already enrolled. Never use a number the caller supplies.
Use a manager or on-camera check for high risk requests. MFA resets and new device enrolment are the dangerous ones. Set a higher bar for them than for a routine unlock.
Slow privileged changes. For admins and engineers with production access, add a delay and a notification to the account's existing devices and to the manager.
Block remote access tools by policy. The advisory recommends allowlisting software and auditing remote access tools. A caller who cannot get a remote session on a laptop loses a lot of leverage.
Make staff safe to refuse. Agents should have written permission to say no to anyone, including someone claiming to be an executive. Pressure is the attack.
Log and review. Record each reset, who handled it, and how identity was proven. Review reset spikes weekly.
Make the account less dependent on the desk
If staff use phishing-resistant MFA, a reset becomes a rare event with a hardware key as the anchor, and a lost key goes through a stricter process. The advisory recommends phishing-resistant MFA such as FIDO or WebAuthn and says it resists push bombing and SIM swaps. Also keep a spare registered key per person so resets are not the default recovery path. See passkey recovery design.
Quick check
Is a callback enough on its own?
It is a strong start, but only if the number comes from a record the caller cannot edit. Add a second approver for privileged accounts.
What is the first thing to change in a weak script?
Remove any step that accepts personal details recited by the caller as proof of identity.
Sources
Last reviewed: 19 October 2026.
