Some of the most damaging cyber-attacks against major organizations didn’t start with a zero-day exploit or malicious attachment delivering sophisticated malware. They started with something far more routine: a call to the service desk.

Social engineering is the defining tactic of the Scattered Spider hacking collective. By researching employees, impersonating them convincingly, and persuading support staff to reset passwords or change authentication factors, attackers turn legitimate account-recovery processes into a route past security controls.

The 2025 attacks on UK retailers show how effective that approach can be. They also expose a wider problem for defenders: strong authentication at login means far less if the process for recovering an account relies on identity checks that an attacker can satisfy.

High Profile Attacks Linked to Scattered Spider

Over the last few years, Scattered Spider has claimed credit for, or has been associated with, several major attacks where social engineering and identity compromise played key roles:

• The 2023 MGM Resorts attack became one of the clearest examples of Scattered Spider’s playbook, with social engineering used to gain access before the incident escalated into widespread disruption and ransomware.
• UK retailer Marks and Spencer (M&S) suffered a highly targeted cyber-attack in April 2025 that caused significant disruption to its online operations and resulted in customer data being taken.
• Co-op was targeted in the same wave of attacks, with attackers using social engineering to gain access to an employee account.
• Harrods was also targeted in April 2025 and restricted internet access across parts of its network after detecting attempts to gain unauthorized access.

How Scattered Spider Tactics Exploit the Service Desk

Step One: Build a Convincing Identity

In the MGM Resorts attack, Scattered Spider reportedly used LinkedIn to identify an employee before contacting the company’s help desk. But professional social media is only one source. Publicly available information on company websites, as well as breach datasets, can help reveal enough about an employee to convincingly impersonate them.

Attackers may then strengthen the social engineering attempt with techniques such as caller-ID or email spoofing. SIM-swapped phones can also be used as part of the attack.

Step Two: Social Engineer a Routine Request

A Scattered Spider operative then calls the service desk pretending to be a real employee needing urgent help. They use situations the service desk deals with every day, such as “I’ve changed phones.” “My authenticator isn’t working.” “I’m locked out and I’ve got an important meeting.” The attacker only needs to provide enough accurate information to build confidence and create enough urgency to keep the interaction moving.

Giving evidence to Parliament after the Co-op attack, CDIO Rob Elsey said the attackers impersonated a colleague, successfully answered several security questions and had the account reset. Around an hour later, the company detected malicious behavior associated with the account.

Step Three: Use Account Recovery to Bypass Authentication

Once the service desk accepts the attacker as the employee, a routine recovery process can become a route around the organization’s security controls.

CISA specifically warns that Scattered Spider uses social engineering to persuade service desk agents to reset credentials and transfer MFA tokens; that then allows the attacker to take over the target account in SSO environments.

The service desk therefore sits upstream of many of the identity controls organizations depend on. A password reset or MFA change may look like an administrative support task, but both are security-sensitive actions capable of determining who the organization trusts as a legitimate user.

The Recurring Weakness: Service Desk Verification

Across Scattered Spider attacks, the service desk is a recurring point of weakness. Attackers look for gaps in account-recovery and identity-verification processes, then use them to turn a convincing impersonation into access.

The problem is not that service desk teams are too helpful, but that they are asked to approve sensitive actions, such as password resets or MFA changes, using information that is weak evidence of identity.

When information like a name, job title, employee number, manager or location is treated as proof of identity, attackers have room to work. They can arrive prepared with the answers, make a routine request, and exploit the same recovery processes designed to help legitimate users regain access.

Training still matters, but it cannot close every gap on its own. Reducing the risk means making sensitive service desk actions depend on stronger, harder-to-bypass verification, which is where the right controls and processes come in.

How to Secure Your Service Desk Against Social Engineering

There are several ways organizations can reduce the risk of attacks like those associated with Scattered Spider:

• Strengthen identity verification for password resets: Use out-of-band checks, such as confirming the request through a known secondary contact method.
• Protect MFA resets and enrolment changes: Require additional verification or approval before MFA can be reset or transferred.
• Train service desk teams to spot social engineering: Pay particular attention to urgent or emotional requests, spoofed internal numbers and attempts to bypass normal processes.
• Monitor unusual service desk activity: Look for patterns such as repeated password resets or MFA removals for privileged accounts.
• Limit service desk privileges: Require escalation before agents can reset credentials or authentication methods for administrative and other high-risk accounts.
• Apply role-based access controls and keep detailed audit logs: Alert security teams to high-risk credential and authentication changes.
• Test your processes regularly: Run social engineering simulations that cover phone and chat-based attacks, not just email phishing.

Strengthen Identity Verification with Specops Secure Service Desk

Specops Secure Service Desk adds identity verification to password reset and account unlock requests, helping service desk teams confirm that the person asking for access is who they claim to be.

Organizations can verify users through MFA, directory attributes or custom challenge questions before allowing a request to proceed. This makes it harder for an attacker to succeed using information such as an employee’s name, role or internal terminology alone.

Secure Service Desk also provides audit trails and granular controls over who can perform different types of resets, helping organizations reduce the risk of impersonation and inappropriate privilege changes.

Want to strengthen your service desk against social engineering? Book a demo with Specops to see how our solutions can help.