[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$feS85mqzuvAQgb2Bu_UAyGfH2UQg96IXF_DF_wRQR-Fk":3},{"article":4,"iocs":49,"watch_terms":53,"solutions":54,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"8fe40f9b-0a75-4c8c-80b5-33475a184105","From Fake Workers to Account Recovery: The Growing Identity Verification Risk","from-fake-workers-to-account-recovery-the-growing-identity-verification-risk-887eef","Attackers are increasingly targeting the processes used to establish or recover identity rather than attacking the login itself. Specops explains how stronger identity verification can help organizations prevent fake workers and social engineering attacks from gaining legitimate access. [...]","Attackers are increasingly bypassing traditional authentication methods by targeting identity verification processes during employee onboarding and account recovery. This includes social engineering service desks and impersonating legitimate users, as seen in North Korean IT worker campaigns and Scattered Spider's tactics linked to the M&S ransomware breach. Organizations need to strengthen these identity checks, as AI-generated synthetic identities and deepfakes further complicate verification.","Attackers target identity verification processes for onboarding and account recovery.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Ffrom-fake-workers-to-account-recovery-the-growing-identity-verification-risk\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fposts\u002F2026\u002F08\u002F19\u002Fspecops-lock-laptop.jpg","2026-08-25T14:01:11+00:00","2026-08-25T16:00:21.056231+00:00",8,[17,20,23],{"name":18,"type":19},"Scattered Spider","threat_actor",{"name":21,"type":22},"Active Directory","product",{"name":24,"type":25},"Specops Software","vendor","2c8f44d4-b56e-47cf-9677-04f22c9ee78d",{"id":26,"icon":28,"name":29,"slug":30},null,"Identity & Access","identity-access",[32,34,39,44],{"category":33},{"id":26,"icon":28,"name":29,"slug":30},{"category":35},{"id":36,"icon":28,"name":37,"slug":38},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50],{"type":51,"value":18,"context":52},"malware","Threat actor group proficient in social engineering for account takeover.",[24,21],{"controls":55,"vendors":137},[56,85,114],{"slug":57,"name":58,"problem":59,"products":60},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":86,"name":87,"problem":88,"products":89},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":115,"name":116,"problem":117,"products":118},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[119,125,130],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":120,"product_name":121,"url":123,"description":124},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":126,"product_name":127,"url":128,"description":129},"managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":115,"product_name":134,"url":135,"description":136},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[],{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":153},"identity-verification-gaps-enable-impersonation-and-insider-threats","Identity Verification Gaps Enable Impersonation and Insider Threats","Attackers are exploiting weak identity verification processes at critical chokepoints — employee onboarding and account recovery — where human judgment and legacy procedures replace robust technical controls. Campaigns like North Korean IT worker infiltration and Scattered Spider's social engineering of service desks demonstrate that even well-defended organizations can be compromised when front-door identity checks fail. AI-generated deepfakes and synthetic identities are rapidly eroding the reliability of document-based and video verification methods. This matters because a successful impersonation at onboarding or account recovery grants attackers legitimate credentials and trusted access, bypassing most downstream security controls entirely.",[143,144,145,146,147,148,149,150,151,152],"NIST SP 800-63A – Digital Identity Guidelines: Enrollment and Identity Proofing (IAL2\u002FIAL3)","NIST AC-2 – Account Management","NIST IA-12 – Identity Proofing","CIS Control 5 – Account Management","CIS Control 14 – Security Awareness and Skills Training","NIST CSF PR.AC-1 – Identities and Credentials are Managed","GDPR Article 32 – Security of Processing (appropriate technical and organisational measures)","ITIL Service Desk Identity Verification Procedures","MITRE ATT&CK T1078 – Valid Accounts","MITRE ATT&CK T1566 – Phishing (Spearphishing for credential harvesting)",{}]