The new front door is a phone call
The helpdesk is the target now, not the employee
Groups like Scattered Spider have shifted their playbook away from technical exploits toward calling helpdesks directly, impersonating an employee locked out of their account, and talking a support agent through an MFA reset. It worked against MGM Resorts in 2023 at a cost north of $100 million, and by 2026 the same playbook has moved decisively into financial services and insurance. The attacker doesn't need to beat your MFA. They need to convince one person to reset it.
Once they're in, MFA doesn't save you
Adversary-in-the-middle kit intercepts the login
Off-the-shelf phishing kits proxy a real login page in real time, capturing the password and the session token behind it.
Session token theft bypasses MFA entirely
The attacker doesn't need the second factor. They already have the authenticated session.
Stolen credential seeds a much larger compromise
A single harvested login becomes lateral movement, privilege escalation, or a ransomware foothold.
You already know this is a problem. Testing for it is a different story.
Only 40% of CISOs name credentials as the data type that would cause the most damage if stolen, ranked no higher than financials or trade secrets. Yet once credentials are abused, perimeter controls and patching offer almost nothing, the attacker is already operating with legitimate access.
It isn't just human identity anymore
Human flank
A helpdesk agent trusts a confident voice on the phone and resets an MFA device that was never actually lost. Trust exploited through fluency and process, not a technical flaw.
Agent flank
An AI agent inherits a cached credential or a delegated token with no distinct identity of its own. Per OWASP's Agentic Top 10, this is one of the most common paths attackers use to escalate access inside agentic systems.
What actually closes the gap
Deploy phishing-resistant MFA on every high-value account
Hardware keys or passkeys remove the credential-theft surface entirely. Password and SMS-based factors are the weakest link left standing.
Treat the helpdesk as a privileged access point, not a courtesy desk
Require a phishing-resistant identity check before any MFA reset, device change, or account recovery action, with no agent discretion to bypass it under pressure.
Bind sessions to devices
Token binding makes a stolen session unusable from anywhere but the original device, closing the AiTM path even after credentials are phished.
Measure click-to-report, not click rate
The median time to click a phishing link is seconds. The median time to report one is closer to half an hour. That gap is where damage happens.
Extend awareness training beyond email
If your simulation program only covers email, it has a blind spot the exact size of a phone call.