Help Desk Impersonation Scam: What SMBs Should Know (2026)

Q: Does multi-factor authentication stop this attack?

Not reliably. Because the attacker captures a valid session token after the victim completes a real MFA approval, standard MFA methods like one-time codes and push approvals do not block it. Phishing-resistant methods such as passkeys and hardware security keys are significantly more effective.

Q: What should an employee do if they get a call from IT support?

Hang up and call the help desk back using a number already on file, never a number or link the caller provides. A legitimate IT team will never ask an employee to approve an MFA prompt they did not initiate.

Q: What should a business do if employee data was exposed in an attack like this?

Confirm what systems and file locations were accessed, notify affected employees promptly, and give them a path to identity monitoring and recovery support, since exposed HR and benefits data can lead to personal identity theft separate from the initial business intrusion.

A director at a mid-sized firm gets a phone call. The caller ID looks internal. The voice says it is IT support, following up on a login issue. It asks the director to click a link and verify the account. Nothing about the call feels unusual, because the attacker built it that way. This is a help desk impersonation scam. A new wave of it is currently targeting executives at small and mid-sized businesses.

Last Updated: September 2026

Security researchers at Arctic Wolf disclosed the campaign on September 7. They track it as PREY-0058. It is not a phishing email, and it is not a mass text blast. It is a live phone call from someone who sounds like they should be on your payroll. And it is working, largely because businesses assume this kind of attack targets IT staff, not executives.

What Happened: A New Help Desk Impersonation Campaign

PREY-0058 is a data theft and extortion operation. It targets Microsoft 365 and other cloud business tools. Arctic Wolf reports the campaign shares tradecraft with a group Google’s Mandiant tracks as UNC6671. A separate extortion group called Cinder likely overlaps with an earlier operation known as Pink. The specific group label matters less than the pattern underneath it. Several active crews are running the same playbook against American businesses right now, and refining it in parallel.

The campaign mainly singles out directors, vice presidents, and other executive staff. It does not focus on general employees. Confirmed targets span construction and engineering, healthcare and pharmaceuticals, real estate and property management, finance, and professional services. That list reads like a cross-section of the small and mid-sized business world. That is exactly why this deserves attention now, before the next round of headlines names a company you recognize.

How the Help Desk Impersonation Scam Works

The attack does not rely on malware. The attacker does not need to break into your network from the outside. It works because it convinces one real employee to open the door from the inside.

The call. An attacker claiming to be internal IT or help desk staff calls the target directly. They often reference a plausible account or login issue to establish credibility fast.
The link. The caller asks the target to visit a page to verify their account, reset a password, or register for multi-factor authentication.
The capture. The page is a convincing fake. The target signs in and approves the MFA prompt. The attacker captures the authenticated session token in real time, a technique known as adversary in the middle, or AitM.
The replay. The stolen session token gets replayed through a residential proxy. This makes the attacker’s login look like an ordinary home internet connection, not a suspicious one.
The harvest. Once inside, the attacker browses SharePoint, OneDrive, Exchange, and Box. They collect whatever files and messages are accessible, then send an extortion demand.

Arctic Wolf found hundreds of lookalike subdomains built to impersonate real companies as part of this infrastructure. The attackers deploy no endpoint malware. They attempt no lateral movement across the internal network. Everything happens inside legitimate, cloud-based tools your business already uses and trusts every day. That is exactly why it does not trip the alarms a traditional malware infection would.

Why Executives Are the Target, Not Just the Help Desk

Most cybersecurity awareness content still frames voice-based scams as a threat aimed at receptionists and front-line staff. That framing is out of date. Verizon’s 2026 Data Breach Investigations Report found the human element present in 62 percent of breaches. Social engineering was the third most common breach pattern overall, at 16 percent. For the first time, the report broke out pretexting as its own initial access vector. Pretexting covers this kind of live-call impersonation. It reached 6 percent of breaches, and it is rising. Verizon’s researchers also found that phone-based social engineering succeeds roughly 40 percent more often than email phishing. Stopping it takes different training than a standard “do not click the link” course, since the target is being asked to be helpful in the moment, not to click something obviously suspicious.

Executives are attractive targets for three reasons. They carry the broadest account access. They get the least day-to-day scrutiny from IT. And they have the least time to double-check an unexpected call before their next meeting. Sophos’s 2026 State of Ransomware report found that 79 percent of ransomware attacks now begin with compromised identities, not a software vulnerability. Businesses with 100 to 250 employees stop attacks before encryption only 34 percent of the time. Larger enterprises stop them 46 percent of the time. Smaller organizations are not just as exposed here. They are measurably worse positioned to catch it in time.

Why MFA Alone Does Not Stop This

Multi-factor authentication is supposed to be the safety net under a stolen password, and it usually is. AitM attacks like PREY-0058 are built specifically to get around it. The victim is not tricked into giving up a password in isolation. They are walked through a real login and a real MFA approval on a fake page. The attacker then captures the session token issued afterward. That token behaves like a valid, already-authenticated login. That is why it survives standard MFA, and why identity itself has become the primary battleground instead of the password field. SpyCloud’s 2026 Identity Exposure Report recaptured 5.3 billion credential pairs from criminal sources in 2025 alone. Eighty percent of exposed corporate credentials sat in plaintext. Nearly half of all phished identities in its dataset belonged to corporate users, not consumers.

Why the Response Window Is Measured in Minutes

Once an attacker has a working session token, they move fast. Sophos’s separate 2026 Active Adversary Report is based on 661 incident response cases. It found the median dwell time before detection down to three days overall. Attackers who gain initial access now reach an organization’s Active Directory server in as little as 3.4 hours. Applied to a help desk impersonation scam, the gap matters. The gap between one employee approving a fake MFA prompt and an attacker pulling files out of SharePoint or Exchange is not a multi-day window. It is a same-day problem. A business that treats a suspicious IT call as something to mention at the next staff meeting is giving the attacker exactly the head start these numbers describe. The same compromised mailbox is how fake wire instructions reach borrowers at a mortgage closing, which is why our mortgage wire fraud prevention guide puts MFA and mailbox checks near the top of its list.

How to Protect Your Business

You do not need an in-house security team to close most of this gap. A few concrete habits go a long way.

Never approve an MFA prompt you did not request. If a push notification appears out of nowhere, deny it and change the password immediately.
Verify the caller through a number you already have on file. Do not use a number they give you, and do not click anything a self-identified IT caller sends.
Move toward phishing-resistant MFA where your provider supports it, such as passkeys or hardware security keys. These are far harder to intercept through AitM than a one-time code.
Use conditional access policies to restrict sign-ins from unexpected locations or unmanaged devices. Watch for a sign-in followed immediately by heavy SharePoint or Exchange search activity.
Put the real policy in writing, in plain language. A legitimate help desk will never ask an employee to approve an MFA prompt or enter credentials into a page a caller sent them.

There is a second layer worth planning for now, not after an incident happens. Attackers pulling data out of SharePoint, OneDrive, Exchange, and Box are not always after corporate secrets. HR files, benefits records, and employee personal information often live in those same systems. An attack aimed at the business can end with individual employees’ Social Security numbers, dates of birth, and personal records sitting in an extortion group’s hands. That is a personal identity theft problem for the people affected, not just an IT incident for the company. Identity theft protection as an employee benefit gives a team somewhere to turn. Monitoring, alerts, and full-service recovery support are available if their information ends up exposed this way, separate from whatever the IT team is doing to secure the network itself.

Frequently Asked Questions

What is a help desk impersonation scam?

A help desk impersonation scam is a social engineering attack. A criminal poses as internal IT or help desk staff, usually by phone, to convince an employee to approve a fraudulent login or multi-factor authentication request. It gives the attacker access without needing malware or a direct network breach.

How is this different from typical vishing?

It uses the same voice-call delivery as other vishing attacks. The specific impersonation of internal IT staff, paired with adversary-in-the-middle token theft, makes it more effective at defeating standard multi-factor authentication than a generic scam call.

Does multi-factor authentication stop this attack?

Not reliably. The attacker captures a valid session token after the victim completes a real MFA approval. Standard MFA methods like one-time codes and push approvals do not block that. Phishing-resistant methods such as passkeys and hardware security keys are significantly more effective.

Who is being targeted by campaigns like PREY-0058?

Arctic Wolf’s research found the campaign mainly targets directors, vice presidents, and other executive staff. Confirmed victims span construction and engineering, healthcare and pharmaceuticals, real estate and property management, finance, and professional services.

What should an employee do if they get a call from “IT support”?

Hang up. Call the help desk back using a number already on file, never a number or link the caller provides. A legitimate IT team will never ask an employee to approve an MFA prompt they did not initiate.

What should a business do if employee data was exposed in an attack like this?

Confirm what systems and file locations were accessed. Notify affected employees promptly. Give them a path to identity monitoring and recovery support, since exposed HR and benefits data can lead to personal identity theft separate from the initial business intrusion.

Help desk impersonation scams work because they exploit trust in an ordinary workplace interaction, not a technical flaw you can simply patch. Training your team to verify before they trust is the first line of defense. Our four-week Cybersecurity Awareness Month plan shows how to fit that training into October. Giving employees a real safety net if their personal information ends up exposed anyway is the second. defend-id gives your team identity monitoring, fraud alerts, and full-service recovery support as a voluntary benefit. A breach at the company level does not have to become a lasting personal crisis for the people who work there. Learn how defend-id can protect your team.

Related Articles

help desk impersonation scam

Share on Facebook