Topic starter
06/11/2026 6:40 pm
TL;DR: Help desk vishing has become the dominant cloud-compromise entry path, with Mandiant’s M-Trends 2026 placing voice phishing at 23% of cloud intrusions in 2025 and CrowdStrike showing attackers use password resets and MFA re-enrollment to reach cloud and SSO accounts, according to imper.ai research. The recovery workflow, not the login stack, is now the primary control gap.
Editorial analysis by NHI Mgmt Group, based on content published by imper.ai: “Vishing is the fastest-growing way attackers are breaking in. Most security stacks cannot see it”.
By the numbers:
- Voice phishing accounted for 23% of cloud intrusions in 2025, according to Mandiant research cited by imper.ai.
- CrowdStrike reported that 82% of detections were malware-free in 2025, up from 51% in 2020, according to CrowdStrike research cited by imper.ai.
- CrowdStrike said 35% of cloud incidents involved valid account abuse, according to CrowdStrike research cited by imper.ai.
Key questions
Q: What are the first signs that help desk vishing has succeeded?
A: The first signs are usually account recovery changes, especially unexpected password resets, MFA re-enrolment, password reset email or phone changes, and unusual help desk case notes.
Q: Why do MFA and conditional access not stop help desk vishing?
A: MFA and conditional access do not stop help desk vishing because the attacker targets the recovery process, not the live login flow.
Q: How should organisations govern password resets for privileged accounts?
A: Privileged password resets should use stronger verification than routine user recovery, with separate approval logic, tighter monitoring, and complete audit logging.
Practitioner guidance
- Lock down recovery authority Remove unilateral reset authority from service desk staff for high-risk identities and require policy-driven approval paths for password resets and MFA re-enrollment.
- Verify the recovery session, not the voice Check device, network, and browser context before any credential state changes are processed, so the request is evaluated in the session that will be used to abuse it.
- Separate reset rights by identity criticality Apply stricter controls to admin, cloud, finance, and directory accounts than to low-risk users, because the blast radius of a reset varies by role and privilege.
Bottom line: Help desk vishing turns the recovery workflow into the real attack surface, which is why traditional sign-in controls do not stop the breach path.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:42 pm
Help desk recovery is now a privileged access decision point, not an administrative afterthought. The dominant vishing pattern works because organisations still treat the reset path as low-risk support while attackers treat it as the shortest route to trusted identity state. Once the reset is approved, the account becomes functionally legitimate to downstream systems. Practitioners should therefore class recovery workflows as part of privileged access governance, not just service operations.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How can organisations reduce the risk of recovery-channel impersonation?
A: Organisations reduce the risk by hardening recovery procedures, verifying callers through independent factors, and restricting what the help desk can change. Use call-backs to trusted numbers, step-up checks from existing records, manager or owner approval for sensitive resets, and logging of every recovery action. Where possible, bind recovery to a known session environment and block changes from untrusted requests.
👉 Read our full editorial: Help desk vishing now drives most cloud compromise entry