Topic starter
06/11/2026 6:39 pm
TL;DR: Voice phishing has become the top initial intrusion vector for cloud compromises in 2025 and the second most common across all intrusions, according to imper.ai’s analysis of Mandiant’s M-Trends 2026 research. The failure point is not login-time MFA but human-verification workflows such as password resets and account recovery, where attackers can exploit time pressure and script-based judgment.
Editorial analysis by NHI Mgmt Group, based on content published by imper.ai: “Help desk vishing: why training isn’t the fix”.
Key questions
Q: How should IT help desks handle voice phishing attacks that target password and MFA resets?
A: Help desks should treat password and MFA reset requests as high-risk events, not routine support.
Q: Why do MFA and conditional access not stop help desk vishing?
A: MFA and conditional access do not stop help desk vishing because the attacker targets the recovery process, not the live login flow.
Q: How does a help desk impersonation attack actually lead to account takeover?
A: A help desk impersonation attack leads to account takeover by convincing support staff to reset a password, issue a temporary credential, or weaken MFA after the attacker has passed basic identity checks.
Practitioner guidance
- Harden password reset workflows Require stronger identity checks for resets, MFA changes, and device re-enrolment than for standard help desk requests, with clear step-up approvals for high-risk accounts.
- Separate recovery from service desk speed metrics Remove pure resolution-speed incentives from high-risk identity recovery paths so agents are not pressured to trade assurance for throughput.
- Verify environmental context before reset approval Check endpoint state, network context, location consistency, and session behaviour before a recovery action is completed.
Bottom line: Voice phishing is exploiting the gap between strong login controls and weaker recovery workflows, which turns help desk operations into an authentication weakness.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:42 pm
Recovery workflows are now part of the authentication perimeter. Organisations that treat login as the only identity checkpoint are defending the wrong boundary. Voice phishing shifts abuse into password resets, MFA changes, and device enrolment, where the real security decision is made by a person rather than a control plane. The implication is that IAM governance has to cover the full identity journey, not just the sign-in step.
A few things that frame the scale:
- Voice phishing was the most common initial infection vector in cloud intrusions in 2025 (23%) and the second most common across all intrusions (11%), according to Mandiant's M-Trends 2026.
A question worth separating out:
Q: What should teams do first when recovery workflows are targeted by attackers?
A: Teams should first lock down the recovery workflows themselves by requiring strong caller verification, out-of-band approval, and documented rollback before any reset or credential reissue happens. Attacks on recovery paths usually target password resets, MFA re-enrolment, and help desk overrides, so those steps need tighter identity checks than ordinary login. Audit logs should be reviewed immediately.
👉 Read our full editorial: Help desk vishing exposes the missing control in IAM recovery