On February 6, 2026, NYDFS issued an industry letter warning DFS-regulated entities about a spike in targeted vishing attacks where threat actors impersonate IT help desk staff to steal credentials and MFA codes. This post breaks down the technical mechanics of the campaign, why it reliably bypasses MFA, and how to detect and contain it using identity telemetry with SlashID Identity Protection, Mutual TOTP verification, and MITM detection.

SlashID Team, Vincenzo Iozzo

Scattered Spider is a highly adaptive cybercrime group that breaches enterprises by abusing identity, trust, and legitimate access paths rather than malware exploits. Learn about their identity-centric attack flow, real-world campaigns like the MGM and Caesars breaches, and how to defend against these sophisticated threats.

SlashID Team, Vincenzo Iozzo

Actor Token Forgery is one of the many techniques adopted by attackers to escalate privileges and move laterally via identity vector. This post reconstructs the attack flow, maps it to MITRE ATT&CK, and outlines immediate detection and defense actions.

SlashID Team, Vincenzo Iozzo