The helpdesk is the new front door for cybercriminals
ShinyHunters is increasingly targeting organisations via vishing, where the helpdesk is deceived into resetting passwords, MFA, or OAuth access. Health-ISAC advises a “no same-call” policy: never perform a reset immediately, but always call back on a known number and create a ticket.
Strong identity verification via an independent channel (out-of-band) and additional approval for accounts with elevated privileges are essential. Furthermore, vishing simulations, targeted awareness training, and clear refusal scripts for helpdesk staff are crucial to stopping social engineering.
Read the Health-ISAC article for more information.