Data Breaches · Credential Theft

Help Desks Became the New Identity Control Plane

The weak point is the identity-reset path, not the endpoint. If an attacker can convince a help desk to reset a password, change MFA, or start a remote support session, they get the same privileges the support team uses to open accounts and grant access.

Recent cases across M&S, Co-op, Harrods, Carnival, and the FBI’s warning on Silent Ransom Group show the pattern keeps working. These attacks bypass software defenses and turn third-party service desks into a relay for account takeover, which is why patch-first thinking misses the blast radius.

1 source · Jun 24

Timeline

• Jun 24 Reported by BleepingComputer

Sources

• Jun 24 BleepingComputer

  Securing the service desk: Why social engineering attacks keep succeeding

  Specops Software breaks down how service desk social engineering attacks work and how organizations can defend against them.

  original

Part of the PlainSec briefing for 2026-06-24

Every edition of this story: Help Desks Became the New Identity Control Plane

More from today

• Klue Token Theft Spreads Beyond One Salesforce Tenant