Skip to content
attack.paths
Connexion
← RegistryDossier · 6 steps · 5 edges

Vishing → helpdesk MFA reset → account takeover

Pose as a panicked employee locked out before a meeting. Helpdesk resets MFA based on partial PII (employee ID + date of birth from LinkedIn). Attacker registers their own factor.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: target's helpdesk handles MFA resets over phone with weak identity proofing (no callback, no manager approval). Attacker has open-source PII from LinkedIn / breaches.

§ Steps

  1. 01
    Authenticate to corporate portalInitial Access
    T1078— Valid Accounts
  2. 02
    Register attacker MFA devicePersistence
    T1098— Account Manipulation
  3. 03
    Collect PII (LinkedIn, Hunter, breaches)Reconnaissance
    W-RECON-GITHUB-DORK— GitHub / GitLab Dorking
  4. 04
    Call helpdesk, vishing pretextInitial Access
    SE-VISHING— Vishing (Voice Phishing)
  5. 05
    Spoof internal phone number / caller IDInitial Access
    SE-PRETEXT— Pretexting
  6. 06
    Convince agent to reset MFACredential Access
    SE-HELPDESK-RESET— Helpdesk Social Engineering — MFA / Password Reset

§ References

§ Frequently asked

What is the "Vishing → helpdesk MFA reset → account takeover" attack path?
Pose as a panicked employee locked out before a meeting. Helpdesk resets MFA based on partial PII (employee ID + date of birth from LinkedIn). Attacker registers their own factor. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Authenticate to corporate portal (T1078) — a initial access primitive. Assumed environment: target's helpdesk handles MFA resets over phone with weak identity proofing (no callback, no manager approval).
What is the final impact of this kill-chain?
The final step lands on Convince agent to reset MFA (SE-HELPDESK-RESET), which falls under Credential Access. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers