Topic starter
25/08/2026 6:10 pm
TL;DR: Voice-based social engineering, public OSINT, and help desk workflow abuse can combine to defeat knowledge-based verification, according to Trusona’s breakdown of Scattered Spider, with CrowdStrike reporting the group used help desk voice impersonation in almost all observed Q2 2025 incidents. The lesson is that identity proofing built on public answers cannot withstand modern impersonation campaigns.
Editorial analysis by NHI Mgmt Group, based on content published by Trusona: “The Scattered Spider Field Manual: How They Pick Targets, Build Profiles, and Make the Call”.
Key questions
Q: What fails when help desk verification relies on knowledge-based questions?
A: Knowledge-based checks fail when the answers are easy to research, infer, or borrow from social media and past breaches.
Q: Why do password resets and MFA rebinds create so much risk?
A: They matter because they change the trust state of the account, not just the user’s ability to sign in.
Q: What are the warning signs that a help desk is being targeted for impersonation?
A: Look for urgent reset requests, callers pushing for MFA changes, requests timed around weekends or shift changes, and repeated attempts against the same identity or vendor support queue.
Practitioner guidance
- Replace knowledge-based verification with device-bound recovery Require an out-of-band proofing step tied to the employee’s enrolled device before any password reset or MFA change is approved.
- Classify account recovery as privileged access Apply stronger approval, logging, and review to password resets, MFA rebinds, and help desk impersonation requests because they change the trust state of the account.
- Reduce public identity exposure Review executive bios, org charts, speaker pages, and other public materials that give attackers reusable answers for impersonation.
Bottom line: Scattered Spider succeeds because help desk verification still depends on information that attackers can research and replay.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/08/2026 6:11 pm
Help desk verification is a weak identity boundary when its answers are public. Scattered Spider succeeds because the support process still treats researched facts as proof of identity. That is not a tooling gap, it is a governance gap in how recovery is authorised. The implication is that recovery should no longer be treated as a conversational check, because conversation is exactly what the attacker controls.
A question worth separating out:
Q: Should organisations trust outsourced support teams with identity recovery?
A: Only if the outsourced process uses the same proofing standard, logging, and approval rules as the internal help desk. Delegating the work does not delegate the risk away, because the attacker only needs one successful recovery decision. The control has to follow the identity action, not the organisational boundary.
👉 Read our full editorial: Scattered Spider shows why help desk identity verification fails