Search — “Scattered Spider”

A sponsored BleepingComputer article by Specops Software argues that knowledge-based verification at service desks lets attackers bypass MFA via social engineering, citing Scattered Spider as a service-desk-focused group. It recommends required, consistent identity verification before password resets or MFA registration. The source describes no specific confirmed intrusion, so hunters should look at service-desk password reset and MFA device registration events for unusual patterns rather than a known signature.

Exaforce (sponsored BleepingComputer piece) reports attackers enumerating or exfiltrating data within 15 minutes of access via stolen GitHub OAuth tokens (gho_), ClickFix lures posing as Claude Code installs dropping a macOS stealer, and Scattered Spider-style help desk vishing with AiTM/device-code phishing. Attackers register their own MFA device and start bulk download scripts 2.5–7 minutes after push approval, and exfiltration continued 44 minutes to 3 hours after IdP session revocation. Hunt for new MFA method registrations from never-seen devices/networks, GitHub tokens bulk-pulling ZIP archives from residential proxies with mismatched user agents, token replay from multiple countries, and inbox rules created during flagged sessions.