Scattered Spider Pays $1000 to Women for Help Desk Attacks
Finn Jensen | Founder, FastPasscorp
Why stronger help desk identity verification is now critical
Social engineering attacks against IT help desks are evolving again—and the latest tactic shows just how far cybercriminal groups are willing to go.
Threat intelligence reports now reveal that attackers linked to Scattered Spider–style cybercrime groups are recruiting women to conduct voice-phishing (vishing) attacks against corporate help desks. The goal is to impersonate employees and convince support staff to reset passwords, bypass MFA protections, or grant access to corporate accounts.
The tactic highlights a growing reality: help desk impersonation attacks are becoming more organized, scalable, and psychologically sophisticated.
And organizations relying on traditional help desk verification methods are increasingly vulnerable.
Women recruited for social engineering attacks
A recent report covered by Help Net Security revealed that a group called Scattered Lapsus$ Hunters (SLH) has been recruiting women to conduct vishing attacks targeting enterprise IT help desks.
According to the report, the group advertises opportunities in public Telegram channels, offering $500–$1,000 per successful call. Recruits are provided with scripts and instructions on how to impersonate employees and request account access changes.
These attacks typically target:
- Password resets
- Multi-factor authentication (MFA) changes
- Account recovery requests
The goal is simple: convince the help desk agent that the caller is a legitimate employee locked out of their account.
⟶ You can read the original reporting here: Scattered Lapsus$ Hunters seeks women for vishing attacks
Why attackers are using this tactic
Cybercriminal groups like Scattered Spider specialize in human-focused attacks rather than technical exploits.
Instead of hacking systems directly, they exploit the support processes designed to help employees regain access.
Recruiting women for these calls may increase the success rate because:
- Different voice profiles may appear less suspicious
- Attackers can follow scripted impersonation scenarios
- Help desk staff are trained to prioritize customer service
This allows attackers to manipulate the natural trust built into IT support interactions.
In other words, attackers are engineering the human side of identity verification.
Help desk impersonation: the fastest path into corporate systems
Help desks have become one of the most attractive targets for attackers.
Groups like Scattered Spider have repeatedly used help desk social engineering to gain initial access to large organizations.
A typical attack follows a familiar pattern:
- The attacker gathers employee information from public sources or breaches
- They call the help desk pretending to be that employee
- They claim to be locked out of their account
- They request a password reset or MFA change
- The help desk grants access
Once inside, attackers can escalate privileges, access sensitive systems, or deploy ransomware.
This approach works because most help desk identity verification relies on common-sense or simple static data elements that attackers can easily bypass.
Traditional help desk verification is failing
Many organizations still rely on outdated verification practices, including:
- Security questions
- Employee ID numbers
- Caller ID
- Static information checks
Unfortunately, attackers can often obtain this information through:
- Social media
- Phishing campaigns
- Data breaches
- Insider leaks
When identity verification relies on what someone knows, attackers only need to gather enough information to impersonate the victim. In many situations questions are not even asked because the agent trusts the voice!
And increasingly, they are doing exactly that.
Workforce identity verification stops impersonation attacks
The only reliable way to prevent help desk social engineering attacks is to verify identity before performing sensitive account actions.
This means replacing trust-based processes with strong workforce identity verification.
Solutions like FastPass Identity Verification Manager (IVM) allow organizations to verify employees securely before help desk actions such as:
- Password resets
- MFA changes
- Account unlock requests
- Privileged access recovery
Instead of asking questions that attackers can answer, the help desk can verify the user through a trusted identity verification process. To make the verification mandatory remove the help desk supporters’ privileges to reset passwords.
This removes the human guesswork that social engineers rely on.
Social engineering attacks are becoming more organized
The recruitment of women for vishing campaigns highlights another important trend: the industrialization of social engineering.
Attack groups now:
- Recruit participants online
- Provide call scripts
- Pay per successful attack
- Target multiple organizations simultaneously
This creates scalable impersonation attacks that can reach hundreds of help desks.
Security teams can no longer assume these attacks are rare or opportunistic.
They are organized operations designed to bypass weak identity verification processes.
The question every help desk must answer
When the next call comes into your IT help desk, the question should not be:
“Do we believe the caller?”
The question must be:
“Can we verify their identity?”
Because when identity verification is strong, social engineering attacks fail—no matter how convincing the caller sounds.
Contact FastPass if you want to discuss your situation and the next step forward to protect your service desk.
