When recovery becomes the attack path

The ShiftAttackers no longer need to steal the credential

The identity lifecycle itself has become the target: convince a legitimate user to approve a reset or enroll an attacker-controlled authenticator.

Recent threat intelligence describes a growing pattern in which intrusion actors impersonate IT or security staff while simultaneously initiating legitimate self-service recovery. The caller manufactures urgency, guides the user through the real workflow, and persuades them to share a one-time code or approve a prompt. In the most direct variation, the attacker never deploys a credential-phishing kit; the organization's own recovery mechanism performs the sensitive change after the user supplies the required approval.

The Attack PathSelf-service can become attacker-assisted service

The adversary combines reconnaissance, a live phone call, and a legitimate recovery transaction into one coordinated takeover.

The sequence is efficient. First, the actor identifies a workforce account and confirms that public self-service recovery is available. Next, they learn which verification methods the workflow offers. While impersonating the help desk on a voice call, they trigger the reset from their own device and steer the victim toward the weakest available challenge. Once the user approves the event, the attacker can reset the credential or register a factor they control, creating valid access that may survive a password change.

This is a policy problem as much as a user-awareness problem. If recovery accepts any enrolled factor, permits initiation from any network, and treats a single approval as sufficient assurance, the attacker controls the timing and selects the most phishable route. Training helps users recognize the call; architecture determines whether one mistake becomes account control.

The Control ModelMake recovery at least as strong as sign-in

Every credential and authenticator change should be governed as a privileged identity transaction.

Resilience also means giving users more than one strong recovery path. Multiple phishing-resistant authenticators across separate devices reduce emergency help-desk resets and remove pressure to reintroduce a weak fallback when a laptop or phone is unavailable.

The Enterprise ResponseSecure the entire identity lifecycle

Strong authentication is incomplete if enrollment, recovery, factor replacement, and exception handling operate at a lower assurance level.

Identity teams should inventory every path that can create or restore access, remove unnecessary public recovery entry points, enforce context-aware policy, and place high-risk changes behind additional verification. Security operations should treat authenticator enrollment and recovery as detection events, with rapid revocation when a new factor is followed by unusual access. Driven helps organizations assess these end-to-end identity journeys, test social-engineering resistance, harden policy, integrate device and network trust, and connect identity telemetry to response workflows — strengthening security without making legitimate recovery unworkable.