Family 10 of 11
Workforce and access social engineering
Attacks that manipulate employees and help desks into handing over access: password resets, MFA fatigue, fake IT support, insider bribery, and fake hires.
Scam types
- Help desk password and MFA reset impersonation
Help desk reset impersonation is an attack in which a criminal phones a company's IT help desk pretending to be an employee, often using personal details found online, and asks for
- MFA fatigue (push bombing)
MFA fatigue, also called push bombing, is an attack in which a criminal who already has your password triggers a flood of login approval prompts on your phone. They hope you will
- Employee SMS phishing (0ktapus-style)
Employee SMS phishing is a campaign of text messages sent to staff, warning that a password has expired or a schedule has changed and linking to a fake company login page. The page
- Email bombing followed by fake IT support
Email bombing with fake IT support is an attack in which criminals flood an employee's inbox with sign-up emails, then call or message them on Microsoft Teams posing as the company
- Callback phishing (fake subscription renewal)
Callback phishing is a scam email about a subscription charge or renewal that tells you to call a phone number to cancel it. The person who answers poses as customer support and
- Vishing into a malicious OAuth connected app
Vishing into a connected app is an attack in which a caller posing as IT support talks an employee into authorising a malicious app on a company cloud service, often by entering a
- Insider bribery and recruitment
Insider bribery is when criminals pay or recruit a company's employees or contractors to misuse their access, for example by copying customer records or installing malware. The
- SIM swap
A SIM swap is a scam in which a criminal persuades your mobile provider to move your phone number to a SIM card they control. Your calls and texts then go to them, including
- North Korean fake IT workers
The North Korean fake IT worker scheme is a hiring fraud in which workers acting for North Korea use stolen or fake identities to get remote technology jobs at foreign companies
- Developer-targeted lures (fake job tests and malicious packages)
Developer lures are attacks aimed at software developers: a fake job offer with a coding test that runs malicious code, a malicious package in a public registry, or a phishing
Real cases
2025-09 · US · Charged · $115M ransom
Scattered Spider: Thalha Jubair charged in New Jersey, 20252025-07 · US · Sentenced · $17M impact
Christina Chapman's laptop farm for North Korean IT workers, 20252025-06 · US · Disclosed
Google Salesforce instance hit by UNC6040 vishing campaign, 20252025-05 · US · Disclosed · $180M estimate
Coinbase support staff bribed to leak customer data, 20252025-04 · GB · Disclosed · £80M impact
Co-op and Harrods cyber attacks, 20252025-04 · GB · Disclosed · £300M estimate
Marks & Spencer cyber attack via third-party impersonation, 20252025-02 · Location not reported · Disclosed · $1.5B stolen
Bybit loses about $1.5 billion to North Korea's TraderTraitor, 20252024-08 · GB · Sentenced · £29M impact
Transport for London hacked after a help desk password reset, 20242024-07 · US · Disclosed
KnowBe4 catches a North Korean fake IT worker it had hired, 20242024-05 · US · Disclosed
Storm-1811 email bombing and fake IT support calls, 20242024-01 · US · Charged · $400M stolen
SIM swap ring charged over $400 million crypto theft tied by press to FTX, 20242023-09 · US · Disclosed
Caesars loyalty database taken after IT vendor social engineering, 20232023-09 · US · Disclosed · $100M impact
MGM Resorts cyberattack after a reported help desk call, 20232023-08 · US · Disclosed
Retool breached through SMS phishing and a follow-up call, 20232022-09 · US · Disclosed
Uber contractor account breached through repeated MFA prompts, 20222022-08 · US · Disclosed
Twilio employees hit by SMS phishing (0ktapus), 20222022-05 · US · Disclosed
Cisco employee targeted by vishing and MFA fatigue, 20222020-07 · US · Sentenced · $118,000 stolen
Twitter account takeover via fake IT help desk calls, 2020