The helpdesk believed the caller. Or the employee typed the code while the stranger stayed on the line.
Either finish works. Across 2021 through 2025 public cases, attackers used LinkedIn recon, urgency scripts, and phone pressure to reach workforce identity. Sometimes they impersonated employees to service desks and walked out with password resets, MFA factor resets, or a swapped phone number on the enrolled factor. Sometimes they steered employees onto fake VPN or IdP pages and harvested passwords plus one-time codes or push approvals in real time. The product is always a secret a human can still produce.
This page is the rolling “what happened” hub for that class. The August 2026 five-week spoofed-login wave aimed at more than 200 organizations is a sibling campaign story, not a rewrite of every older helpdesk case: five-week vishing harvested MFA codes at 200 orgs. Prevention-side mechanics live on the companion: phishing-proof MFA stops workforce MFA vishing.
How the call finishes before anyone notices
Start with reconnaissance. Public IR write-ups on Scattered Spider-style activity describe callers who already know names, managers, last four of SSN, or “new phone” cover stories. Mandiant’s UNC3944 reporting (June 2024) frames the helpdesk as the door: claim a lost device, pass soft identity checks, reset password and MFA, then ride Okta or SSO into SaaS.
Corporate filings fill in company names without needing Hollywood detail. MGM Resorts’ September 2023 disclosures sit next to IR claims of a short helpdesk call after LinkedIn recon. Clorox’s later complaint against Cognizant alleges callers posing as employees obtained password and MFA resets from an outsourced service desk on 11 August 2023. Okta’s Cross-Tenant Impersonation advisory shows the privileged end of the same idea: reset MFA for Super Admins, then abuse inbound federation.
The other costume is coached login. Twilio’s 2022 employee voice-phishing notice, Cisco Talos’s MFA fatigue plus vishing write-up, GuidePoint’s VPN portal harvest campaign, and Princeton’s 2025 OIT-themed fake sign-on plus Duo push all rhyme. The employee is on a live call. The page looks right enough. The second factor is something they can still approve or type. The attacker spends it on the real service.
Why “we have MFA” still lost on the phone
MFA that an employee can read aloud, paste into a form, or tap Approve under urgency is still a transferable proof. MFA that a helpdesk can reset after a persuasive story is still a recoverable secret. Attackers do not need to break cryptography. They need a human who can complete the ceremony for them.
Push bombing shows up as a sibling tactic in some cases (Cisco 2022). The fatigue softens the victim. The voice call supplies the trust. Neither step requires malware on a corporate laptop for the initial identity win. Later ransomware, Salesforce connected-app abuse, or payroll diversion is whatever access that identity already bought.
Session cookies and cloud tokens appear after the phishable step succeeds. Stealing a cookie from a machine that already held a good login is a different, harder path. The phone script usually never needs that path.
Years of the same playbook, different logos
Archive seed incidents on this hub’s Updates list are not a complete victim census. They are evidence the class repeats: EA IT social engineering for an MFA token (2021), Robinhood support-employee vishing (2021), Twilio and Cisco (2022), Okta Cross-Tenant and Clorox and MGM (2023), Michigan Medicine and TfL and Seyfarth (2024), Marks & Spencer, Co-op, UNC6040 Salesforce vishing, and Okta’s payroll-pirates helpdesk pattern (2025).
CISA and FBI’s AA23-320A advisory on Scattered Spider put the helpdesk MFA-reset pattern in government language. That does not mean every later retailer incident is the same actor. It means defenders keep meeting the same human door.
A fix exists for the transferable-factor problem. The companion on mfa2point0.com covers prevention without retelling every filing here.
FAQ
How does workforce MFA vishing usually work?
Workforce MFA vishing usually works by putting a live coach on the phone who either talks helpdesk staff into resetting passwords and MFA factors or walks an employee through a fake login that collects passwords plus one-time codes or push approvals. Public cases from MGM-style helpdesk resets to spoofed VPN and IdP pages show the same class: a human still holds a secret the attacker can spend.
Did every named company in this hub use the same MFA product?
No. Public reporting often leaves the MFA method unnamed. The shared weakness is the factor class (resettable or transferable proofs), not a single brand.
Is helpdesk impersonation different from employee code harvest?
They are two finishes of the same social-engineering class. Helpdesk impersonation abuses recovery and issuance. Coached code harvest abuses the login ceremony. Both need a transferable factor. Some campaigns use both.
How does the August 2026 200-org wave story relate to this hub?
The August 2026 post covers one multi-week campaign that harvested MFA codes through spoofed login pages at more than 200 organizations. This hub tracks the multi-year helpdesk and coaching pattern across incidents.
Where is the prevention write-up?
The prevention companion is on mfa2point0.com: phishing-proof MFA stops workforce MFA vishing. This page stays on what the calls actually did.
Updates
2026-10-30: New incident
Microsoft Threat Intelligence documented 2026-10-30 human-operated cases where callers impersonating IT/help desk on Teams coached users into interactive remote access, after which ESC1/ESC8 AD CS abuse, DCSync, and file-server exfiltration followed.
Source: Microsoft Security Blog, Microsoft Teams Help Desk Impersonation to AD CS Abuse · Full analysis: legacymfa.sucks
2026-10-29: New incident
Cisco Talos documented a Q3 2026 VYPR ransomware engagement where a vishing call tricked a user into starting Microsoft Quick Assist, after which the actor used existing RMM software, disabled EDR and AV with multiple vulnerable drivers (BYOVD), exfiltrated data over multiple days, and encrypted with Conti-derived VYPR.
Source: Cisco Talos, VYPR Ransomware via IT Help Desk Vishing · Full analysis: legacymfa.sucks
2026-10-28: New incident
Canadian Help Desk Vishing Campaign (AL26-028) documented callers impersonating internal IT for urgent passkey or MFA changes, coaching employees through fake logins, then registering attacker MFA methods and abusing Microsoft 365 after the social-engineered session.
Source: cyber.gc.ca, Canadian Help Desk Vishing Campaign (AL26-028) · Full analysis: legacymfa.sucks
2026-10-26: New incident
Arctic Wolf’s Microsoft Teams IT Support Impersonation incidents (2026-10-26) documented that MFA and tenant controls still failed when actors used external Teams chat and voice under names like “IT Support (Internal)” to socially engineer RMM installs and hands-on access within minutes.
Source: Arctic Wolf Labs, Microsoft Teams IT Support Impersonation (Arctic Wolf) · Full analysis: legacymfa.sucks
2026-10-19: New incident
In the Sophos X-Ops M365 SSPR Vishing Intrusion, investigators documented that an employee still read an SMS MFA verification code to a caller impersonating help desk in an SSPR flow, and that failure enabled device-backed persistence, Graph reconnaissance, mailbox and SharePoint theft, and SaaS data export.
Source: sophos.com, Sophos X-Ops M365 SSPR Vishing Intrusion · Full analysis: legacymfa.sucks
2026-10-15: New incident
COPC documented that a Chaos-claimed vishing intrusion in 2026 still failed to stop voice-pretext workforce MFA social engineering before attackers reached files with names, SSNs, limited health data, and other identifiers, even though the incident was later contained and MyChart stayed unaffected.
Source: copcp.com, Central Ohio Primary Care Physicians (COPC) · Full analysis: legacymfa.sucks
2026-10-10: New incident
Dexcom documented that targeted vishing events preceded unauthorized access to limited information from certain internal documents before containment, forensics engagement, and added security measures.
Source: dexcom.com, Dexcom · Full analysis: legacymfa.sucks
2026-10-02: New incident
iRhythm Technologies documented a social-engineering breach of workforce access to hosted business applications that enabled multi-day patient-data theft and a ransom demand, showing legacy MFA-centered controls still failed to stop social-engineering pretext abuse.
Source: The Record, iRhythm Technologies · Full analysis: legacymfa.sucks
2025-12-15: Threat intel pattern
Okta Threat Intelligence documented “payroll pirates” who socially engineer IT helpdesks to reset employee passwords, enroll attacker MFA methods, then alter payroll banking in HR apps.
Source: Okta Newsroom, Payroll pirates target help desks
2023-09-12: Named victim filing
MGM Resorts disclosed a major September 2023 cybersecurity incident in SEC filings amid public reporting of helpdesk social engineering against workforce identity.
Source: SEC EDGAR, MGM Resorts 8-K
2023-08-14: Named victim filing
Clorox’s 14 August 2023 Form 8-K disclosed unauthorized activity and operational disruption later tied in public reporting to service-desk social engineering.
Source: SEC EDGAR, Clorox 8-K
2023-07-29: Vendor advisory
Okta’s Cross-Tenant Impersonation advisory documents social engineering of IT service desks to reset MFA factors for highly privileged Super Administrator users, then abuse inbound federation to impersonate users across the tenant.
