Overview
A Dark Reading piece published October 23, 2026 makes a point that incident responders keep seeing: threat actors no longer need malware to breach an organization. They call the help desk, politely ask for access, and get help from artificial intelligence to sound credible.
We could not retrieve the full article, so this summary sticks to its stated premise and adds clearly marked general guidance.
Why Help Desks Are the Target
- The help desk exists to restore access quickly, so its incentives favor speed over suspicion.
- A password or MFA reset gives an attacker a legitimate session, with no exploit and no malware alert.
- AI can make the pretext more convincing, for example through scripted conversations or cloned voices.
Hardening Guidance
This section is general best practice and is not taken from the article.
| Control | Why it helps |
|---|---|
| Out-of-band verification | Call back on a number from the directory, never one the caller provides |
| Manager or in-person approval for MFA resets | Removes the single-call failure point |
| No resets on privileged accounts by phone | Forces a stronger process where impact is highest |
| Short-lived access after a reset | Limits what a successful fraudster can do |
| Alerting on new MFA devices | Detects the abuse even when the call succeeds |
| Scripted refusal and escalation paths | Lets agents say no without penalty |
Train help desk staff on current pretexts, and test the process with authorized social engineering exercises.