Scattered Spider Bypasses MFA via Help Desk Social Engineering
Researchers detail how threat actors trick support staff into resetting credentials and hijacking multi-factor authentication to enter corporate networks.
Key points
- Scattered Spider uses social engineering to manipulate help desk workers into resetting passwords or moving MFA devices.
- Attackers gather public data to create convincing identities, bypassing technical controls by exploiting account recovery processes.
- Flare researchers note this method targets people rather than software flaws, though attribution requires additional evidence.
The threat group known as Scattered Spider is exploiting corporate help desks to bypass multi-factor authentication and gain access to enterprise networks. According to Cyber Security News, this intrusion cluster persuades support staff to reset credentials or register attacker-controlled devices by posing as legitimate employees who have lost access to their accounts.
Instead of targeting software vulnerabilities directly, these operators focus on the human element of identity management. They call help desks claiming to be workers locked out before critical meetings or those who have changed phone numbers. By providing personal details gathered from public sources, they convince agents to authorize account changes that grant them full access to the victim’s digital identity.
How the Attack Works
Multi-factor authentication typically requires users to prove their identity through multiple methods, such as a password and a prompt on a mobile device. However, if an attacker convinces a help desk agent to reset the account or register a new authentication device, the technical controls are effectively neutralized. The attacker can then pass subsequent login checks as if they were the legitimate employee.
The vulnerability lies not necessarily in the MFA technology itself, but in the processes used to change the methods tied to an account. Once the support process is manipulated, the attacker gains entry to email systems, single sign-on portals, virtual private networks, and various cloud services. This approach turns routine account recovery procedures into significant security risks for organizations.
Attribution and Analysis
Researchers at Flare, including cybersecurity expert Jon DiMaggio, describe Scattered Spider as an intrusion cluster that specifically targets help desks, identity systems, and account-recovery workflows. They emphasize that this is a people-centered route into enterprise identity systems rather than a campaign dependent on new software flaws or technical exploits.
The group is also tracked under aliases such as UNC3944 and Octo Tempest, with security agencies monitoring related activity under different labels. Flare researchers warn that a help desk call alone is insufficient proof of Scattered Spider involvement. Proper attribution requires additional supporting evidence, as similar social engineering tactics can appear alongside other methods used to pressure or trick users.
What should you do?
Organizations should review their help desk protocols to ensure that account recovery processes include robust verification steps beyond basic identity questions. Security teams must recognize that technical controls like MFA can be bypassed if the underlying identity management processes are not secure against social engineering attempts.
Background: Social engineering
Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.
Read the full guide: Social Engineering Warning Signs and How to Respond
What to do and how to stay safe: Scattered Spider
- Audit help desk scripts to ensure agents verify identity through out-of-band methods rather than relying solely on information provided by the caller.
- Train support staff to recognize signs of social engineering, such as urgency or claims of lost devices, and require managerial approval for sensitive account changes.
- Monitor identity systems for unusual activity, such as new device registrations or password resets, especially when they occur outside normal business hours.
- Ensure that multi-factor authentication changes require additional verification steps that cannot be easily spoofed by attackers with public data.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How does Scattered Spider bypass multi-factor authentication?
They use social engineering to trick help desk workers into resetting passwords or registering new authentication devices controlled by the attacker.
Is this attack based on a software vulnerability?
No, Flare researchers describe it as a people-centered route that exploits account recovery processes rather than a new software flaw.
How can organizations verify if Scattered Spider was involved?
Attribution requires more than just a help desk call; analysts need additional supporting evidence to confirm the group's involvement.
