When employees return from a holiday, help desks expect a flood of password reset requests. We turned that expectation into a live vishing attack that walked straight through multi-factor authentication (MFA).
No malware. No phishing link. Just a phone call and a story nobody wanted to question.
The vishing setup
When one of our Swarm operatives called this client’s internal support line, we weren’t posing as a sophisticated APT group. We were posing as something far more dangerous: an employee back from holiday, asking for a little leniency.
The pretext was simple: “I’m supposed to be logged in from home on my laptop, and I’m going to get in trouble if I don’t send this email.”
No drama, just the familiar pressure of someone getting through a normal workday. A touch of worry in the voice. The quiet scramble of someone who knows their manager is already watching the clock. All we needed was “just a quick reset.”
The gatekeepers bite back
The client’s support team didn’t fold immediately. We hit a verification maze: some questions we answered correctly, some we talked around entirely.
Then came the gem: “Who’s the bald guy in your team?”
Here’s the honest part: even Google couldn’t save us on that one. A confident tone and some conversational drift got us over that tripwire anyway.
The fall of the MFA wall
With enough trust earned, the dominoes fell:
- Password reset issued
- MFA device changed
- Burner phone registered
- Full mailbox access granted
This is the part where most real-world attackers disappear into an account for months. Worse, we only needed minutes to pull off this MFA bypass.
From inbox to impact
With access secured, a second Swarm operative joined the operation. Together, we started enumerating:
- Internal project data
- Sensitive client information
- Credentials and access tokens
- Internal workflows ripe for exploitation
The downstream effect: we weren’t after data. We wanted to show how fast an attacker could cause business-critical damage by exploiting human trust and weak verification hygiene.
What we proved
This vishing attack confirmed a foundational truth: if your people can be talked into it, your perimeter doesn’t matter.
Which means the MFA bypass we pulled off had nothing to do with technology. It came down to a support process built to help fast, not to doubt a caller who sounded stressed.
Multi-layered checks only work when:
- Staff apply them consistently
- Staff feel confident holding the line
- The culture is comfortable saying “no,” even to an “employee in trouble”
Most help desk scripts are built for speed, not for resisting sustained pressure from a caller who sounds legitimately anxious. That’s the gap a vishing attack exploits, and it’s rarely closed by better technology alone.
The client now uses this case as internal training for why MFA procedures, identity verification, and refusal protocols exist.
What would a five-minute phone call cost you?
One phone call bypassed MFA and walked out with full mailbox access. Contact CovertSwarm to run the same pretext against your own help desk, and find the gap before a real attacker calls.