Topic starter
24/06/2026 10:04 pm
TL;DR: The MGM attack discussion frames vishing as a help desk compromise that can bypass MFA, expose reset workflows, and prolong recovery when identity proofing relies on static employee data, according to 1Kosmos. The case shows that authentication strength alone is not enough if support processes still trust information attackers can steal or infer.
Editorial analysis by NHI Mgmt Group, based on content published by 1Kosmos: “Identity Based Authentication: The Key to Preventing Future MGM-Style Attacks”.
Key questions
Q: What breaks when help desk identity proofing relies on employee data?
A: The reset path breaks first.
Q: Why do vishing attacks still lead to remote access even when MFA is enabled?
A: Because the attacker is not bypassing MFA in a technical sense, they are using social engineering to trigger a legitimate login or recovery flow.
Q: How should organisations secure help desk account recovery?
A: They should treat recovery as a privileged identity action and require proofing that is harder to steal, guess, or socially engineer.
Practitioner guidance
- Harden credential recovery paths Map every password reset, factor re-enrolment, and account unlock path as if it were an authentication journey.
- Separate support authority from identity reissue Restrict who can approve identity changes, and add supervisory review for actions that alter authenticators or reset access state.
- Replace weak knowledge checks with stronger verification signals Use identity proofing that binds the requester to a device, factor, or live verification step instead of relying on personal facts that can be harvested from public sources.
Bottom line: The MGM example shows that a help desk can become the point of compromise when recovery processes trust information an attacker can obtain or infer.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 6:51 am
Recovery workflows are now the soft underbelly of identity governance: the MGM case shows that attackers do not need to break the strongest factor if they can control the path that reissues it. That turns account recovery into the real trust boundary, not the login screen. Practitioners should govern reset and proofing flows as high-risk access paths, because that is where the identity model failed.
A few things that frame the scale:
- Voice phishing was the most common initial infection vector in cloud intrusions in 2025 (23%) and the second most common across all intrusions (11%), according to Mandiant's M-Trends 2026.
A question worth separating out:
Q: What should security teams do when social engineering targets the support desk?
A: They should test the support workflow, not just the user login flow. The right response is to validate whether help desk staff can be pressured into issuing resets, and whether the downstream identity changes are visible quickly enough to stop the takeover before the attacker can use the new access.
👉 Read our full editorial: MGM vishing shows help desk identity controls still fail
This post was modified 1 day ago by NHI Mgmt Group