Topic starter
24/06/2026 9:21 pm
TL;DR: The MGM and Caesars attacks show how social engineering, stolen credentials, and MFA bypass can still defeat enterprise identity controls, according to 1Kosmos, with Reuters linking Scattered Spider to 52 attacks since 2022. Legacy MFA assumes the authenticator proves the person, but attackers now exploit account recovery, help desks, and alternate identity providers instead.
Editorial analysis by NHI Mgmt Group, based on content published by 1Kosmos: “MGM, Caesars Hacks: More of the Same Is Coming Your WayâBut Here's How to Stop It”.
Key questions
Q: What breaks when legacy MFA is paired with weak account recovery?
A: Legacy MFA breaks down when support staff or recovery workflows can reset access without strong identity proofing.
Q: Why do alternate identity providers create a higher identity risk than ordinary login changes?
A: Alternate identity providers can redefine which identity source the enterprise accepts, so a compromised admin path can bypass the original MFA control altogether.
Q: What are the warning signs that MFA governance is too easy to bypass?
A: Common warning signs include frequent support-driven resets, broad administrator ability to enroll authenticators, weak logging around federation changes, and outsourced help desk processes that can authenticate users without strong proofing.
Practitioner guidance
- Lock down recovery workflows Require stronger identity proofing for password resets, factor resets, and help desk escalations so a support interaction cannot become a trust shortcut.
- Treat identity provider changes as privileged events Put creation, modification, and deactivation of identity providers under privileged access review, approval, and full audit logging.
- Separate factor enrollment from admin rights Prevent the same administrative role from both enrolling new authenticators and approving high-risk authentication policy changes.
Bottom line: The article shows legacy MFA can be bypassed when attackers target support workflows, admin rights, and federation rather than the login prompt itself.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 6:32 am
Legacy MFA is a control around login, not a governance model for identity trust. The article shows attackers winning before the MFA challenge mattered by exploiting support workflows, administrative rights, and alternate trust paths. That means the security problem is not whether the factor is strong enough, but whether the programme still assumes the only dangerous moment is initial sign-in. Practitioners should treat identity assurance as a lifecycle issue, not a single checkpoint.
A question worth separating out:
Q: How should security teams reduce vishing success against privileged users?
A: Security teams should harden the workflows that vishing targets first: password resets, MFA resets, help desk overrides, and privileged support requests. Require out-of-band verification, separate approval paths for high-risk users, and telemetry that flags unusual recovery activity. The goal is to make persuasion insufficient on its own, even when the attacker sounds legitimate.
👉 Read our full editorial: Scattered Spider shows why legacy MFA is failing enterprise identity
This post was modified 1 day ago by NHI Mgmt Group