A recent analysis from Dark Reading highlights a shift that every SOC and identity team needs to internalize: threat actors are increasingly abandoning malware-heavy intrusion chains in favor of a far cheaper, far more reliable technique — calling the help desk and simply asking for access. With AI-generated voice cloning, synthetic identities, and scraped personal data from breaches and social media, an attacker can sound exactly like your CFO, your new hire, or your traveling executive, and politely talk an agent into resetting a password, re-enrolling MFA, or adding a new authentication device.
This is not theoretical. The Scattered Spider / UNC3944 campaigns that devastated MGM Resorts and Caesars Entertainment in 2023 used exactly this playbook, and in 2025-2026 the technique has been industrialized with generative AI. Groups tracked as Scattered Spider (and its overlaps with Octo Tempest) continue to target SaaS-heavy enterprises, telecoms, financial services, and now healthcare and aviation — and their initial access vector is overwhelmingly social engineering of help desk staff, not exploitation of a software vulnerability. No CVE, no exploit chain, no EDR telemetry to catch. The "vulnerability" is a human process: identity verification at the help desk.
For defenders, this changes the detection problem entirely. You cannot patch a phone call. What you can do is (1) instrument the identity layer so that help desk-driven credential and MFA manipulation is high-fidelity telemetry, (2) enforce verification workflows that an AI-cloned voice cannot satisfy, and (3) hunt the post-reset behaviors that follow a successful social engineering breach. This post covers all three.
Technical Analysis: How the Attack Actually Works
The attack chain
Based on public reporting on Scattered Spider TTPs (MITRE ATT&CK T1656 – Impersonation, T1078 – Valid Accounts, T1556 – Modify Authentication Process) and the Dark Reading coverage, the typical chain looks like this:
- Reconnaissance. The actor harvests employee PII from breach dumps, LinkedIn, data broker sites, and prior phishing. They identify help desk phone numbers, internal naming conventions (employee ID formats, manager names), and the identity stack in use (Okta, Entra ID, Duo, Ping).
- AI-assisted impersonation. A voice cloning model (trained on as little as 3-10 seconds of audio from an earnings call, podcast, or voicemail greeting) generates a convincing real-time voice. Some crews use live social engineers; others use synthetic voice end-to-end. Caller ID spoofing makes the call appear to originate from an internal or known external number.
- The ask. The actor requests a password reset and MFA reset/transfer to a "new phone" — often wrapped in urgency ("I'm boarding a flight," "I have a customer demo in 20 minutes"). They may answer knowledge-based verification questions correctly using harvested PII.
- Credential and MFA capture. The agent resets the password and either disables MFA or enrolls an attacker-controlled device/phone number. In more mature campaigns, the actor instead pushes the victim to an adversary-in-the-middle (AiTM) phishing page to capture the session token, making MFA irrelevant.
- Post-compromise. Within minutes to hours: SSO access to the entire SaaS estate, cloud console access, VPN enrollment, deployment of remote access tools (AnyDesk, ScreenConnect, TeamViewer) for persistence, data exfiltration from SharePoint/Snowflake/Salesforce, and in many cases ransomware deployment or extortion.
Why traditional controls fail
- MFA is not the control — the reset process is. If an attacker can get MFA re-enrolled to their device, MFA protects them, not you. SMS and voice-based MFA are especially weak here since the "new phone number" is the attacker's.
- EDR sees nothing until stage 5. There is no malware in stages 1-4. The first endpoint telemetry you get may be a legitimate signed binary (AnyDesk) installed by a "valid" user session.
- KBA is dead. Any verification question answerable from public data (mother's maiden name, employee ID, last four of SSN, manager's name) is answerable by a prepared attacker.
- Voice is no longer an authentication factor. Treat any voice-only verification as zero trust value in 2026.
Exploitation status
This technique is in confirmed, active, widespread use. It is the signature initial access method of Scattered Spider/UNC3946-linked operations, which CISA documented in advisory AA23-352A and which remain active through 2025-2026 across SaaS, telecom, and financial verticals. No CVE is associated — the attack surface is process and identity configuration, which is precisely why it is so effective.
Detection & Response
The highest-fidelity detection opportunities sit at the identity layer: the password reset, the MFA modification, and the immediately-following authentication behavior. The rules below are tuned to fire on the sequence and context of these events, not merely their existence — help desks legitimately reset passwords all day.
---
title: Password Reset Followed by MFA Method Change Within Short Window
id: 3f8a2c71-9b4e-4d6a-bc15-7e2f1a8c9034
status: experimental
description: Detects a user password reset closely followed by an MFA method addition or change, a hallmark sequence of help desk social engineering attacks such as Scattered Spider campaigns where attackers convince agents to reset credentials and re-enroll MFA to attacker-controlled devices.
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a
- https://attack.mitre.org/techniques/T1656/
- https://attack.mitre.org/techniques/T1556/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.persistence
- attack.t1078
- attack.t1556
logsource:
product: azure
service: auditlogs
detection:
selection_reset:
operationName|contains:
- 'Reset user password'
- 'Change user password'
selection_mfa:
operationName|contains:
- 'User registered security info'
- 'User changed default authentication method'
- 'User deleted security info'
- 'Admin updated security info'
condition: selection_reset or selection_mfa
falsepositives:
- Legitimate user self-service password and MFA changes via SSPR; correlate events by target user within a 30-minute window and flag pairs initiated by help desk or admin principals
level: high
---
title: Suspicious Authentication From New MFA Device After Admin-Initiated Reset
id: 8c1d4e92-3a6f-4b58-ad27-9f4c2b1e7538
status: experimental
description: Detects sign-in activity from a previously unseen device, ASN, or geography shortly after an administrator or help desk principal performed a credential or MFA reset on the account. Strong indicator of successful voice-phishing driven account takeover.
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a
- https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.initial_access
- attack.t1078
- attack.t1656
logsource:
product: azure
service: signinlogs
detection:
selection_risky:
RiskDetail:
- 'unfamiliarFeatures'
- 'anonymizedIPAddress'
- 'maliciousIPAddress'
- 'unfamiliarLocation'
Status|contains: 'Success'
filter_known:
ResultType: '0'
condition: selection_risky and not filter_known
falsepositives:
- Traveling executives on new networks; tune by suppressing users with compliant managed devices and requiring correlation with a preceding reset event before escalation
level: medium
---
title: Remote Access Tool Installation Following Account Anomaly
id: 5b9e3f14-2c7a-4d91-be36-4a8d1c6f9021
status: experimental
description: Detects installation or execution of remote access tools commonly deployed by Scattered Spider and similar actors for persistence immediately following help desk social engineering, including AnyDesk, ScreenConnect, TeamViewer, Splashtop, and Level.io.
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a
- https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.command_and_control
- attack.t1219
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- '\AnyDesk.exe'
- '\ScreenConnect.ClientService.exe'
- '\TeamViewer.exe'
- '\TeamViewer_Service.exe'
- '\SplashtopStreamer.exe'
- '\SRManager.exe'
- '\level.exe'
- '\dwagent.exe'
- '\rustdesk.exe'
filter_approved:
CommandLine|contains:
- 'C:\Program Files\'
- '/S'
condition: selection_img and not filter_approved
falsepositives:
- Approved remote support tooling; maintain an allowlist of sanctioned RMM products and installation paths per your software inventory before deployment
level: high
// Hunt: Password reset followed by MFA change and anomalous sign-in within 60 minutes
// Surfaces the exact sequence used in help desk social engineering intrusions.
// Requires: Azure AD Audit Logs + Sign-in Logs ingested into Sentinel.
let window = 60m;
let Resets =
AuditLogs
| where OperationName in ("Reset user password", "Change user password")
| extend TargetUser = tostring(TargetResources[0].userPrincipalName),
InitiatedBy = tostring(InitiatedBy.user.userPrincipalName)
| where InitiatedBy != TargetUser // admin/help desk initiated, not self-service
| project ResetTime = TimeGenerated, TargetUser, InitiatedBy, ResetResult = Result;
let MfaChanges =
AuditLogs
| where OperationName has_any ("security info", "authentication method")
| extend TargetUser = tostring(TargetResources[0].userPrincipalName)
| project MfaTime = TimeGenerated, TargetUser, MfaOp = OperationName;
Resets
| join kind=inner MfaChanges on TargetUser
| where abs(datetime_diff('minute', MfaTime, ResetTime)) <= 60
| join kind=inner (
SigninLogs
| where ResultType == 0
| extend DeviceId = tostring(DeviceDetail.deviceId),
Location = tostring(LocationDetails.countryOrRegion)
| project SigninTime = TimeGenerated, UserPrincipalName, IPAddress, Location, DeviceId, AppDisplayName
) on $left.TargetUser == $right.UserPrincipalName
| where SigninTime between (ResetTime .. ResetTime + window)
| project ResetTime, TargetUser, InitiatedBy, MfaOp, SigninTime, IPAddress, Location, DeviceId, AppDisplayName
| order by ResetTime desc;
-- Hunt for unauthorized remote access tools deployed post-compromise
-- Run fleet-wide to surface RMM binaries outside approved install paths
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)(anydesk|screenconnect|teamviewer|splashtop|rustdesk|dwagent|level\.exe|srmanager)'
AND NOT Exe =~ '(?i)Program Files\\\\(YourApprovedRMM)'
ORDER BY CreateTime DESC
# Audit Entra ID for help desk-initiated resets and MFA changes in the last 24 hours
# Requires: Microsoft.Graph PowerShell module, AuditLog.Read.All permission
Connect-MgGraph -Scopes "AuditLog.Read.All","Directory.Read.All" -NoWelcome
$since = (Get-Date).AddHours(-24).ToString("yyyy-MM-ddTHH:mm:ssZ")
# Pull admin-initiated password resets (exclude self-service)
$resets = Get-MgAuditLogDirectoryAudit -Filter "activityDateTime ge $since" -All |
Where-Object { $_.ActivityDisplayName -match 'password' -and
$_.InitiatedBy.user.userPrincipalName -ne $_.TargetResources[0].userPrincipalName }
$resets | Select-Object ActivityDateTime,
@{n='InitiatedBy';e={$_.InitiatedBy.user.userPrincipalName}},
@{n='TargetUser';e={$_.TargetResources[0].userPrincipalName}},
ActivityDisplayName, Result |
Export-Csv -Path ".\HelpdeskResets_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
# Pull MFA method registrations/changes in same window for cross-reference
$mfa = Get-MgAuditLogDirectoryAudit -Filter "activityDateTime ge $since" -All |
Where-Object { $_.ActivityDisplayName -match 'security info|authentication method' }
$mfa | Export-Csv -Path ".\MfaChanges_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
Write-Host "Review both CSVs: any account appearing in BOTH files within 60 minutes warrants immediate investigation."
Remediation: Hardening the Human Layer
1. Rebuild help desk identity verification — this week, not this quarter.
- Eliminate KBA entirely. Require verification via a factor the attacker cannot fake: a manager callback to a number on file, an in-person badge check for on-site staff, or an IT-approved authenticator challenge to the existing enrolled device.
- For MFA resets and new device enrollment, require a second-person approval (dual control) for privileged accounts, executives, and finance roles.
- Institute mandatory cooling-off delays (e.g., 1-4 hours) between an MFA reset request and fulfillment for high-risk accounts, with out-of-band notification to the user and their manager.
- Record and transcribe all help desk calls; alert on keywords ("new phone," "lost my phone," "MFA," "reset") for QA and retro-hunting.
2. Deploy phishing-resistant MFA and kill the bypass paths.
- Move to FIDO2/passkeys or certificate-based auth. Phishing-resistant MFA removes the AiTM and push-fatigue paths entirely. Follow CISA's guidance in AA23-352A and the CISA phishing-resistant MFA fact sheet.
- Disable SMS and voice call as MFA methods in Entra ID/Okta authentication method policies — these are the exact factors attackers ask help desks to enroll.
- Enforce Conditional Access: block sign-ins from non-compliant devices, unknown locations, and anonymizing networks, especially in the hours following any credential change.
3. Instrument and alert on the identity sequence. Deploy the Sigma and KQL detections above. The reset-then-MFA-change-then-new-device-login sequence within a one-hour window is your single highest-fidelity signal for this threat class.
4. Contractually enforce verification on third parties. MGM's breach flowed through a third-party provider's help desk. Your vendors' help desks are your help desks. Require documented verification procedures, dual-control MFA resets, and breach notification SLAs in contracts.
5. Rehearse it. Run tabletop and live-fire vishing simulations against your own help desk quarterly. Measure pass rates, not awareness training completion. If your agents fail a cloned-voice simulation, your MFA stack is decorative.
The uncomfortable truth in this story is that the strongest technical stack in the world is one polite phone call away from bypass. The fix is not more tooling — it is treating identity verification as a security control with the same rigor as your firewall ruleset: documented, enforced, monitored, and tested.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.