Topic starter
09/07/2026 3:19 pm
TL;DR: Vishing attacks jumped 449% in 2025 and are being used to drive password resets, MFA changes, token theft, and service-account creation that can reach Active Directory within hours, according to Commvault. The real problem is not only initial access but the combination of human trust abuse, NHI sprawl, and slow recovery that lets attackers consolidate control.
Editorial analysis by NHI Mgmt Group, based on content published by Commvault: “When the Help Desk Becomes the Front Door to Your Entire Network”.
By the numbers:
- Voice phishing jumped 449% in 2025.
Key questions
Q: What breaks when help desk resets are trusted too easily?
A: When help desk resets are treated as routine, attackers can turn password changes and MFA updates into authenticated entry.
Q: Why do service accounts and tokens make vishing attacks worse?
A: Because they convert a short-lived human compromise into longer-lived machine access.
Q: What are the signs that Active Directory governance is failing in a large enterprise?
A: Common warning signs include inconsistent Group Policy behavior, broken inheritance, circular nesting, unexpected domain administrator access, and privileged changes that appear in logs but are not quickly reconciled.
Practitioner guidance
- Correlate help desk events with identity changes Tie password resets, MFA modifications, account unlocks, and new service-account creation into one alerting path so a benign-looking support ticket becomes a security signal when the sequence lines up.
- Inventory non-human identities and their owners Build a complete register of service accounts, API keys, tokens, and other machine credentials, including business owner, technical owner, and last-reviewed date.
- Audit AD for legacy trust paths Review privileged groups, legacy protocols, and directory-level permissions that let a newly compromised identity move from user access to administrative control without obvious friction.
Bottom line: Help desk vishing can convert routine support actions into the first stage of identity compromise when resets and MFA changes are not tightly correlated.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 3:37 pm
Help desk vishing is now an identity governance failure, not just a social engineering event. The article shows that support workflows can be converted into privileged identity changes with little friction when callers are treated as legitimate by default. That changes the control problem from email security to identity process assurance. The practitioner implication is that the help desk itself has become part of the attack surface.
A few things that frame the scale:
- 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data, according to the Ultimate Guide to NHIs.
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should identity teams prioritise recovery or prevention after help desk vishing?
A: They need both, but recovery has to be designed as a first-class control because prevention will not stop every social engineering attempt. The practical question is whether teams can detect unauthorized changes, roll them back, and restore trusted directory state before the attacker consolidates control.
👉 Read our full editorial: Help desk vishing is accelerating identity compromise through AD