The Help Desk That Called You — Vishing to Identity-Provider Takeover and Extortion — severe-but-plausible scenario — ITOL

Vector: Cyber · Severity: severe

An employee's personal phone rings. The caller is 'IT', the number matches the real help desk, and the ask is the passkey enrolment the bank has been emailing about for weeks. The link is a lookalike enrolment page that relays the credential and the MFA (multi-factor authentication) token. Inside the hour the actor holds a session in the identity provider (the system that signs staff in). Scripts pull mail and files from Microsoft 365 and Okta, password resets go out for every application that sits outside single sign-on, and the confirmation emails are deleted as they land. No malware is dropped. The ransom note follows.