As reported by Dark Reading, threat actors are increasingly bypassing technical defenses entirely by calling help desks and simply asking for access — with AI making the impersonation more convincing than ever. This is not a new tactic, but the scale and sophistication have reached an inflection point.
What Dark Reading describes aligns with a pattern Shield53 has been tracking for the last 18 months: identity-based attacks are replacing malware-based intrusions as the preferred initial access vector. When an attacker can convince a help desk technician to reset an MFA device or issue a new credential, no exploit is needed, no payload is detected, and no EDR alert fires. The breach happens inside the trusted identity plane.
Why This Shift Is Happening Now
Three forces are converging:
Who Is Most Exposed
Organizations with large, decentralized IT support operations are at the highest risk — particularly those using outsourced or geographically distributed help desks where technicians lack face-to-face familiarity with employees. Financial services, healthcare, and large enterprises with legacy identity governance programs are especially vulnerable. Companies that recently completed mergers or acquisitions, where help desk consolidation is still maturing, are also prime targets.
The Verification Gap
Most help desk verification protocols still rely on knowledge-based authentication: manager name, department, start date. But this information is effectively public now. The real gap is that organizations haven't evolved their out-of-band verification processes to match the threat. A caller who can recite an employee's manager, department, and parking spot isn't authenticated — they've just demonstrated OSINT proficiency.
The fundamental issue: organizations are trusting identity claims at a time when the inputs that prove identity are publicly accessible and forgeable with AI. Trust must be earned through cryptographic proof, not social proof.
Shield53 Recommendations
- Eliminate knowledge-based verification for credential resets. Replace with out-of-band push-to-mobile confirmation to a pre-enrolled device, or require callback to a number on file — never to a caller-provided number.
- Implement step-up verification for high-risk actions. Password resets, MFA re-enrollment, and email forwarding rule changes should require manager approval through an independent channel.
- Adopt FIDO2 phishing-resistant MFA. Replace SMS and TOTP-based MFA entirely. WebAuthn-bound credentials cannot be socially engineered away because there is no transferable credential for an attacker to request.
- Train help desk staff on AI-enabled social engineering. Focus not on verbal cues but on process discipline: never deviate from verification protocols under time pressure or emotional appeals.
- Log and alert on identity-centric anomalies. Impossible travel for credential resets, multiple reset requests for the same account, or changes to MFA enrollment outside business hours should trigger automated holds.
- Run purple team simulations against your help desk. Tabletop this scenario quarterly. If your help desk can be compromised with a phone call and a LinkedIn profile, your perimeter is fiction.
The organizations that treat the help desk as a security boundary — not a convenience function — will be the ones that survive the next wave of identity-based attacks. Trust is not a default state. It must be engineered, verified, and continuously validated.
