The Caller Said He Was From IT: Close the Exposure Patching Will Never Fix

The views expressed are my own and do not represent those of my employer.

Imagine you are a CISO preparing for a board committee meeting. Your patch dashboard is green. Critical vulnerabilities on internet facing systems are closing inside SLA, and the trend line points the right way. You walk in feeling good.

At the same hour, a third shift supervisor at one of your sites gets a Teams chat from "IT Support." The account name looks official. The message says a security update needs a quick remote session. The supervisor wants the line running, so the answer is yes. By the next afternoon, files are encrypting. No scanner flagged anything, because nothing was unpatched.

That exposure has no CVE number. No vendor will ship a fix for it. This is part 4 of 5 in my vulnerability management update series.

I covered exposure management back in April 2026. If you are new to the idea, start with Stop Scanning. Start Managing Exposure. This post picks up where that one left off and adds the paths your scanner cannot see: the help desk phone, external Teams chats and the identity provider.

Why Your Patch Dashboard Is Blind to This

IANS covers these incidents in its Q3 2026 Vulnerability and Breach Update, published October 20, 2026. IANS commentary on that update argues that teams should rank fixes by real exploitation and exposure, not CVSS. I agree. I would push the idea one step further. Exposure includes every path an attacker can use, and some of those paths run through people and processes.

A CVE is a flaw in software. A help desk that resets MFA for a confident voice is a flaw in a process. An open Teams federation setting is a configuration choice. A single sign on session that reaches twenty applications is an architecture decision. Scanners see none of them.

A patch dashboard measures one way attackers get in. It says nothing about the others.

This matters for your career as much as your company. If the board hears "green" and then reads about a breach that began with a phone call, the green stops meaning anything.

The Help Desk Is a Login Page With a Phone Number

Attackers learned that the easiest authentication system to defeat is a friendly person trying to help. Google Threat Intelligence Group published an assessment on August 6, 2026 describing extortion groups that call employees on personal mobile numbers, impersonate colleagues or IT support, and direct targets to spoofed authentication pages. Reporting on the wave against financial firms says attackers captured one time MFA codes live during the call, then took over accounts to steal data.

Voice phishing into single sign on is the other variant. ShinyHunters told BleepingComputer it got in through vishing calls to employees at a large healthcare distributor, took over Okta single sign on accounts, then moved into Salesforce and Snowflake and pulled about a terabyte over four days. Treat those numbers as claims. The pattern is what matters. A phone call became an identity compromise, and the identity compromise became a data export.

The Teams Message That Never Came From IT

Sophos documented a campaign it tracks as STAC4749. Between February and June 2026, Sophos observed the actors targeting dozens of North American organizations. The operators started contact through Teams chats and calls, impersonating help desk or IT support staff. They used custom .top domains to make the fraudulent accounts look more credible.

The goal was to get an employee to launch a remote tool. Operators favored Microsoft Quick Assist at first, then deployed a cloud based tool called RemSupp when Quick Assist was blocked or unavailable. At least three compromises led to Chaos ransomware, and in one incident the time from initial access to deployment was under 17 hours.

If you run plants, read the sector numbers. Services organizations were 20 percent of incidents, followed by manufacturing at 17 percent, energy at 12 percent, and construction and engineering at 12 percent. Nearly 95 percent of cases targeted organizations in Canada and the U.S.

The attacker did not need a vulnerability. The attacker needed one employee who wanted to be helpful.

When the Identity Provider Falls, Everything Behind It Falls

MFA is not the finish line. In 2026, CloudSEK analyzed a phishing as a service operation called BigBear 2.0. It bypassed MFA at 258 organizations and stole more than 5,000 Microsoft 365 credentials. The service is built on Evilginx2, which places an attacker controlled reverse proxy between the victim and Microsoft's legitimate authentication service. The victim completes MFA as usual. The infrastructure intercepts the authenticated session cookie and the attacker reuses it.

One detail matters most to defenders. CloudSEK found custom code that disabled FIDO2 and WebAuthn options on the phishing pages, forcing victims toward weaker MFA methods. A hardware key in a drawer does not help if the user can still pick SMS.

Now connect that to blast radius. Once an attacker holds a valid session in your identity provider, every application behind it sits a short walk away. That is how one claimed SSO foothold reached a CRM and a data platform.

Fix the Help Desk Script This Week

Start here. It is the cheapest control on this list, and attackers hit it most often.

Require callback verification. Every request for a password reset, MFA reset or new device enrollment ends with a callback to the number on file in your HR system. Never use a number the caller offers. Never accept caller ID as proof. Callers have spoofed the legitimate help desk number.

Never reset MFA on voice alone. A confident voice and a correct employee ID are not identity. Add a ticket and a callback. For administrators, executives and finance staff, add confirmation from the manager through a separate channel.

Give the help desk the right to say no. The best script fails if the analyst fears a senior executive's temper. Tell help desk leaders, in writing, that a refused reset will never be punished. Then teach every employee one plain sentence: IT never needs your one time code.

Close the Chat Door and Name One Remote Tool

Restrict external Teams access to an allow list of partner domains you can name. Open federation is convenient, and nobody can defend it in an incident review. For anything outside the list, block first contact chats or label them so employees see the warning every time.

Then pick one approved remote support tool and make everything else unavailable. Sophos saw operators move from Quick Assist to RemSupp when the first tool was blocked. Block through policy and application control, not by one executable name. If your approved tool is not Quick Assist, turn Quick Assist off.

Finish with a message employees can repeat: IT uses this one tool, and IT starts a session from a ticket, never from a chat you did not open.

Harden the Identity Provider Before Someone Tests It

Administrators first. Move admin accounts to phishing resistant MFA, meaning FIDO2 security keys or passkeys. Remove the weaker fallbacks for those accounts. BigBear's code was built to push users toward exactly those fallbacks.

Conditional access. Require managed, compliant devices for sensitive applications. BigBear routed traffic through IP addresses in the victim's country, which reduces the chance that location based controls block the session. Location rules alone are weak.

Fast session revocation. Practice it before you need it. For suspected session theft, defenders should revoke active sessions and refresh tokens, force reauthentication, and review new MFA registrations and mailbox rules. A password reset alone does not end the attacker's access.

The SSO blast radius map. List your most important applications. For each, write down what one SSO session reaches: CRM, data warehouse, ERP, email. Start with the roles that reach the most. The map tells you where to add step up authentication first.

Plant and Night Shift Verification

Attackers call when verification is thinnest. At a manufacturer, that often means third shift, when the help desk is lightly staffed and a supervisor cannot walk down the hall to confirm anyone's identity.

Write a night process. Name an on call help desk lead with callback authority. Post the number where supervisors can find it. Decide how shared kiosks and shared accounts get reset. Cover contractors, who rarely appear in HR records.

Give plant managers a one page card with the approved tool, the callback rule and the sentence that IT never asks for codes. Remote sessions are the normal support path on a plant floor, so the one tool rule matters most there.

One Tabletop and Four Measures

Run one tabletop of about 60 minutes. The scenario: an external Teams chat reaches a night shift supervisor, a remote session starts, and an hour later someone calls the help desk asking for an MFA reset on a finance account. Remember the Sophos clock of under 17 hours in one incident. Ask who can disable external Teams in an hour, who can revoke every session for a user, and who calls the business owner.

Then track four measures. Reset verification rate: sample resets monthly and report the share that followed callback verification. External chat exposure: count the external domains allowed to message employees, and drive the number down. Admin coverage: report the share of administrator accounts on phishing resistant MFA with no weak fallback. Revocation time: measure minutes to revoke all sessions for one user.

That last measure belongs beside the containment numbers I described in Why Mean Time to Contain (MTTC) Matters.

Getting Organizational Support

The board. Speak in business risk, not tool names. Tell the board that patch numbers measure one way attackers get in, and that you are adding phone and chat paths to the exposure inventory. Explain the consequence in their terms: production downtime, extortion, data theft and the disclosure that follows. Then show the four measures. I wrote about holding this kind of conversation in Winning the Room.

The CEO and CFO. Ask for one specific commitment: when the help desk refuses a senior executive, leadership backs the help desk. That single decision does more than any tool purchase. Frame the cost as hours of lost production against the price of a verification step.

IT operations and the help desk. They own the controls, so treat them as partners. Bring the script, the authority to refuse and the reason, and ask what will break. Expect pushback on ticket volume and handle it with data.

HR and legal. HR owns the records you use to verify identity. Legal needs to approve any live test of the help desk and will want to know about notification duties early.

Plant and business leaders. Show them the one page card. Ask each site to name a night shift contact. A two minute callback costs far less than a stopped line.

Employees. Give them one sentence and a place to report calls. If you already report identity metrics, add these four to the pack I described in The Audit Chair Asked What the Identity Program Returned.

Key Points

• A patch dashboard measures one way in. Phone and chat paths need their own inventory.
• Callback to the number on file, every time. No MFA reset on voice alone.
• Restrict external Teams to named partner domains.
• Approve one remote tool and block the rest by policy.
• Put administrators on phishing resistant MFA first and remove their weak fallbacks.
• Practice session revocation and measure the minutes.
• Map what one SSO session reaches.
• Build a night shift verification path before an attacker tests it.

Pro Tips

Test the help desk, then coach, never blame. With written approval from legal and IT leadership, place one sanctioned call asking for a reset. Share the result as a training case. The point is a better script, not a scapegoat.

Read identity and data logs together. A valid password plus a live MFA code can make a cloud session look like authorized activity unless identity and data telemetry are investigated together. Bulk exports from CRM and data platforms right after an unusual login are the signal.

Alert on new MFA enrollments. One threat report on the ShinyHunters pattern says the group established persistence through MFA enrollment changes after compromising Okta accounts. A new authenticator on an account that did not ask for one deserves a page.

Train for the personal phone. Awareness programs are built around email. Attackers call personal mobile numbers, outside your controls. Tell employees to hang up and call back through the number on file.

Pitfalls to Avoid

Do not treat this as an awareness problem alone. A help desk that follows a weak process will fail no matter how well it is trained. Change the process first.

Do not block one remote tool and call it done. Operators switch tools. Control the behavior with an approved tool and application control.

Do not trust MFA as a checkbox. If weak fallbacks remain available, an attacker's proxy will steer users to them.

Do not forget the revocation drill. Resetting a password without killing sessions leaves the door open. Practice the full sequence.

Do not leave the night shift out. A process that only works from eight to five protects the hours attackers avoid.

Final Thought

Patching will always matter, but attackers choose the cheapest door, and more often than not the cheapest door is a person with a phone and a good reason to say yes, so build your program around the paths your scanner cannot see.

If this post changed how you think about exposure, leave a comment with the control you will add first. Subscribe to InfoSec Made Easy so you do not miss the rest of this series, and share this with the help desk lead you trust most. I read every one.