Some of the most effective intrusions of the last two years used no malware at all. Somebody rang the help desk, sounded convincing, and got a password reset. Cloned voices have made that conversation harder to win.
The most consequential intrusions of the last two years did not begin with an exploit. They began with somebody being helpful.
An attacker calls the service desk. They have the target's name, their manager's name, their employee number, the name of the project they are working on and a plausible reason to be locked out. They are calm, apologetic and slightly rushed, which is exactly how a real person behaves in that situation. The agent follows the process, verifies what the process says to verify, and resets the credential.
Reporting from Mandiant on the group tracked as Scattered Spider, also catalogued as UNC3944, has documented intrusions moving from a single help desk call to domain administrator in well under an hour, using no malware whatsoever. Researchers at ReliaQuest and others have tracked the same pattern spreading across sectors, and by 2026 the authentication recovery channel is widely described as one of the most productive account takeover routes operating.
There is nothing to detect on the endpoint, because nothing ran. There is nothing malicious in the email gateway, because no email was sent. The security stack most organisations have spent a decade building is pointed somewhere else entirely.
Every technical control assumes an attacker is doing something abnormal. Here, nobody is.
The help desk agent followed the documented process. The password reset is a routine operation performed hundreds of times a month. The subsequent login uses valid credentials and passes multi factor, because the attacker enrolled their own factor during the reset. From the identity provider's perspective, an employee had trouble, contacted support, was verified, and got back to work.
The only unusual thing in the whole sequence was a human judgement made under time pressure by somebody measured on how quickly they resolve tickets.
Your help desk holds the ability to reset any credential in the organisation, and it is usually the least resourced function that touches identity.
Until recently an agent had an instinct to fall back on. The voice did not sound right. The accent was wrong. Something was off.
That instinct is no longer reliable. Voice cloning from a few seconds of public audio is commodity technology, and an executive who has appeared on a podcast, a webinar or a conference recording has supplied plenty of training material. Live video is following the same curve. An agent may hear the correct voice, see a familiar face, and be speaking to somebody else entirely.
United States health sector guidance has explicitly flagged AI voice impersonation as a factor making remote identity verification harder, and the practical conclusion is uncomfortable but clear. Anything a person can see or hear down a phone line or video call is no longer evidence of who they are.
Which means verification has to move to things a caller cannot fake by being convincing.
Verify with something cryptographic, not something known. Knowledge based verification is finished. Employee number, manager's name, date of birth, last four digits of anything. All of it is available from a breach dump, a LinkedIn profile or a pretext call to a different department. Push a verification request to an enrolled device, use a hardware token, or require an in person or video check against the record held in HR rather than against the caller's appearance.
Break the single point of failure. High impact resets, meaning administrators, finance and anyone with production access, should require approval from a second party who is not on the call. The attacker's whole method depends on one person being persuaded in one conversation.
Add friction where it costs least. A callback to the number on record rather than the number calling in. A short mandatory delay on privileged resets. A notification to the account holder and their manager on every reset, so the real person can raise the alarm. None of these are sophisticated and all of them break the pattern.
Separate password reset from factor enrolment. These frequently travel together, and they should not. Enrolling a new authentication factor is the step that actually hands over the account, and it deserves stronger verification than restoring access to an existing one.
Give agents permission to refuse. This is the cultural control and it is the one that matters most. If your service desk is measured on resolution speed and satisfaction scores, you have built an incentive structure that rewards being talked into things. An agent who slows a call down and turns out to be wrong must be supported for it, visibly, or nobody will do it twice.
Watch what happens after the reset. A credential reset followed within minutes by a new factor enrolment, a login from an unfamiliar location and access to a sensitive system is a recognisable sequence. Most organisations hold all three signals in separate systems and correlate none of them.
Reading a policy does not prepare anybody for a confident caller with correct information and a deadline.
Run the scenario. With permission and proper scoping, have somebody attempt a reset against your own help desk and see what happens. Every organisation we have done this with learns something, and it is almost never what they expected to learn. Usually the process is sound and an exception path nobody documented turns out to be the way through.
Then run it as a tabletop exercise with the identity, service desk and security teams in the same room, because the gap is normally in the handoff between them rather than inside any one of them.
We think the help desk is now an identity control and should be resourced, tested and audited as one. In most organisations it sits in IT operations, is measured on speed, and has never been in scope for a security assessment. That mismatch is the vulnerability, and no amount of endpoint tooling addresses it.
Our security awareness practice trains this specific scenario with service desk teams rather than delivering generic phishing modules, because the people who answer those calls face a different attack from everyone else in the building. Our VAPT and red team engagements include authorised social engineering against the recovery channel, which is consistently among the most sobering results we deliver.
If a call does succeed, our DFIR practice works the identity timeline, and the question that follows is always the structural one. What did that account reach, and who else needs to know today. That is what ControlGraph is built to answer, and CyberNexus keeps the record of what was changed afterwards and who accepted that it was enough.
Ring your own service desk as a member of staff and ask for a password reset.
Write down exactly what they asked you for. If every item on that list is something an attacker could find on LinkedIn or in a breach dump, you have just found the way in, and it took one phone call.
An attack where somebody contacts IT support impersonating an employee to obtain a password reset or enrol a new authentication factor, taking over the account without malware or exploitation.
Primarily by calling service desks with accurate personal details and persuading agents to reset credentials and multi factor enrolment. Public incident reporting documents escalation from the initial call to domain administrator in under an hour in some cases.
It defeats verification that relies on recognising a voice or face. Cloning needs only seconds of public audio. Verification has to move to cryptographic proof, such as a push to an enrolled device or a hardware token, rather than anything a caller can perform.
Use device based or hardware verification instead of knowledge questions, require second party approval for privileged accounts, separate factor enrolment from password reset, call back the number on record, and notify the account holder and their manager on every reset.
Yes, with written authorisation and agreed scope. It is one of the highest value tests available, and the finding is usually an undocumented exception path rather than a flawed written process.
A growing share of extortion skips the ransomware entirely. Nothing is locked, nothing breaks, and the first sign is an email naming files you recognise. Backups do not help with this one.
Read the article
Continuous threat exposure management is the phrase of the year and most implementations of it are a scanner on a schedule. What separates the version that changes decisions from the version that produces a longer list.
Read the article
Security stacks grew by accumulation rather than design. The result costs a fortune, produces more alerts than anyone can read, and leaves gaps between products that nobody owns. How to consolidate without losing coverage.
Read the articleIf this raises a question about your own compliance position or your security operations, the quickest route is a direct conversation.
