Closing the Identity Gap at the Service Desk
Attackers target IT service desks to bypass MFA by impersonating employees and convincing staff to reset passwords or register new authentication devices. Specops Software explains why traditional identity verification methods are no longer sufficient and how organizations can secure account recovery against social engineering risks.
Excerpt from the primary source: BleepingComputer
Who is affected
Home users
What you should do · Review
Check whether this affects your accounts or devices, and follow the steps in the linked sources.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Original reporting
Related
mSecure password manager hack prompts password reset warnings
mSeven Software is warning current and former mSecure password manager customers to change passwords, reset two-factor authentication, and remove passkeys following a cyberattack that reportedly exposed an encrypted customer database.
Google Calendar phishing campaign hijacks sessions, bypasses MFA
A phishing campaign used Google Calendar invites, trusted redirects, and fake login pages to hijack corporate Google sessions and bypass MFA protections. Material Security examines how Operation CloudFire tracked the attacks, blocked malicious messages, and helped take down nearly 900 domains used by the attackers.
Phishing-Resistant Isn't Enough; Yubico Takes Aim at Identity-Verification Gap
The new YubiID service bridges identity verification with credential enrollment and recovery across existing identity platforms, closing a phishing-resistant authentication gap. Plus: post-quantum YubiKey beta.
Passkeys Are Better Than Passwords. But They Are Not Enough.
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.