Threat Spotlight: Scattered Spider and the Rise of Help-Desk Social Engineering

Some of the most damaging intrusions of recent years — including attacks on major casino and retail groups attributed to the loose collective tracked as Scattered Spider — began not with an exploit but with a phone call. Young, fluent-English attackers ring a help desk, impersonate an employee, and simply ask for what they need: a password reset, an MFA device change, "I got a new phone, can you re-enrol me?"

The toolkit is human, not technical

• Help-desk impersonation: enough personal detail (scraped from LinkedIn and past breaches) to pass casual verification.
• MFA fatigue: bombarding a real user with push prompts until they tap approve to make it stop.
• SIM swapping: convincing a telco to move the victim’s number, capturing SMS codes.
• Urgency and authority: "I’m presenting to the board in ten minutes" remains devastatingly effective.

Why this matters to businesses far smaller than casinos

The technique scales down perfectly. In an SMB, the "help desk" is whoever knows the systems — an office manager, the external IT provider. A caller claiming to be a staff member locked out before payday triggers the same helpful instincts, with even less formal verification in the way. Your IT provider’s reset process is part of your attack surface: ask them what it is.

Rituals beat instincts

• Fixed verification for resets and MFA changes: call back on the number in the HR system, or verify face-to-face on video — every time, even for the CEO.
• Number-matching MFA prompts (typing a code shown on screen) instead of blind approve-buttons.
• Treat MFA re-enrolment as a privileged event that generates an alert someone reviews.
• Give staff social permission to say no to urgency: "our process is a callback, I’ll ring you straight back".

You can’t patch people, but you can give them a script. Attackers exploit improvisation; rituals remove it.