Sep 22, 2026 · 34 min
Help-desk impersonation puts privileged access within reach
Storm clouds over the waterworks.
Fast-moving social-engineering attacks are testing whether financial institutions can defend identity systems when training and annual controls fall short.
- 1Scattered Spider profiles organizations and targets help desks to obtain credentials, API keys, and privileged access.
- 2Vishing campaigns pressure victims to enroll passkeys or alter MFA while attackers pose as technical support.
- 3Information sharing and controls beyond annual awareness training are essential because attacks unfold rapidly and simultaneously.
Don't miss
Marc Woolward describes attackers calling business or personal phones as technical support and pressuring victims to enroll passkeys or change MFA.
The brief
Marc Woolward explains how groups such as Scattered Spider profile organizational weaknesses, then use help-desk impersonation to pursue passwords, API keys, and privileged access.
The same playbook is reaching hedge funds and financial institutions after attackers gained experience in hospitality, retail, and other sectors, including MGM Resorts.
Voice phishing adds pressure: attackers call business or personal phones as technical support and push victims to enroll passkeys or update MFA.
Woolward argues that annual security training cannot match attacks that happen quickly and simultaneously; information sharing and stronger controls must carry more of the defense.
The interview closes with a practical warning: identity and help-desk processes are now central security boundaries, not merely support functions.