Fala com um especialista
PreçosNotíciasFala com um especialista
Voltar à sala de imprensa
Ameaças

Scattered Spider Bypasses MFA by Calling the Help Desk

Scattered Spider gets past MFA by convincing help desk agents to reset passwords or enroll new devices. Here's how the attack works and how to harden account recovery.

4T4Tify Team4Tify
Oct 21, 2026·5 min de leitura
Scattered Spider Bypasses MFA by Calling the Help Desk

Scattered Spider Targets the Help Desk, Not the MFA

Multi-factor authentication is only as strong as the process used to reset it. Scattered Spider has shown that again and again: instead of attacking the technology, its operators call the IT help desk, pretend to be an employee, and talk an agent into resetting a password or enrolling a new MFA device.

What happened

New threat research describes Scattered Spider (also tracked as UNC3944 and Octo Tempest) as an intrusion cluster built around social engineering against help desks, identity platforms and account-recovery workflows. The playbook is simple:

  • Reconnaissance. Operators collect details on a target employee from professional profiles, company websites, leaked datasets and other public sources.
  • The call. Posing as that employee, they claim a lost phone, a new number or a lockout right before an important meeting, and use the gathered details to sound legitimate.
  • The reset. If the agent accepts those details as proof of identity, the attacker gets a fresh password or their own device registered for MFA, and then passes the next login check as the real user.

From there, one account can open email, SSO portals, VPN and cloud services. The researchers also place the group inside a wider ecosystem: Scattered Spider and ShinyHunters share personnel and tradecraft, and since August 2025 both have operated under a common "Scattered LAPSUS$ Hunters" brand used for extortion and recruitment. The original LAPSUS$ group itself is no longer active.

Why it matters

No software vulnerability is involved. The weak point is a support process designed to be helpful. The technique sits next to other ways of pressuring users, such as MFA fatigue (flooding a user with push prompts until one is approved) and SIM swapping (hijacking the phone number that receives codes). CISA and partner agencies have documented all three.

After a takeover, attackers may escalate privileges, set up persistence or abuse legitimate remote-management tools, which makes the activity hard to tell apart from normal IT work. In some cases this has led to data theft, extortion or ransomware; DragonForce has come up in advisory reporting on the group. A RAT named RattyRAT also appears in the analysis, but no hashes or network indicators have been published.

Two cautions apply. First, a help-desk reset does not automatically mean the whole network is compromised; the blast radius depends on the account's permissions and on how fast defenders respond. Second, help-desk vishing is now common across the cybercrime ecosystem, so a call like this is not, on its own, proof that Scattered Spider was involved. Attribution needs technical and infrastructure evidence.

What to do

  1. Make recovery a security control. Changes to passwords, phone numbers or MFA methods should be verified through a trusted second channel or contact details already on file, never through information the caller provides.
  2. Add friction to high-risk changes. Require manager or security-team approval for MFA re-enrollment on privileged accounts.
  3. Train the help desk to pause. Urgency, VIP pressure and requests to skip normal checks are red flags, not reasons to rush.
  4. Move to phishing-resistant MFA. FIDO2/WebAuthn and other public-key methods resist push bombing and SIM swaps far better than SMS or push approvals.
  5. Alert on the sequence. Watch for new MFA registrations, bursts of prompts, and a recovery followed by a login from an unfamiliar device or location.
  6. Limit the blast radius. Review SSO scope and admin rights so one reset cannot reach every system.

These pretexts run on personal data, and much of it comes from breaches and leaks. Our Deep/Dark Web monitoring helps teams learn when employee credentials or personal details are circulating, so they can tighten verification for exposed staff before someone calls the help desk using their name.

MFA still matters. It just can't make up for a recovery process that a convincing caller can talk their way through.

Credit: this piece builds on original reporting by Cyber Security News and research by Flare.

PARTILHAR