From Fake Workers to Account Recovery: The Growing Identity Verification Risk
Attackers target identity verification processes for onboarding and account recovery.
Attackers are increasingly bypassing traditional authentication methods by targeting identity verification processes during employee onboarding and account recovery. This includes social engineering service desks and impersonating legitimate users, as seen in North Korean IT worker campaigns and Scattered Spider's tactics linked to the M&S ransomware breach. Organizations need to strengthen these identity checks, as AI-generated synthetic identities and deepfakes further complicate verification.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Specops Software?
Get an email when a new story names Specops Software, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers are exploiting weak identity verification processes at critical chokepoints — employee onboarding and account recovery — where human judgment and legacy procedures replace robust technical controls. Campaigns like North Korean IT worker infiltration and Scattered Spider's social engineering of service desks demonstrate that even well-defended organizations can be compromised when front-door identity checks fail. AI-generated deepfakes and synthetic identities are rapidly eroding the reliability of document-based and video verification methods. This matters because a successful impersonation at onboarding or account recovery grants attackers legitimate credentials and trusted access, bypassing most downstream security controls entirely.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Scattered Spider