Help-desk and MFA manipulation attacks don't bother with malware: an attacker calls IT support pretending to be a locked-out employee, or floods a target's phone with MFA push prompts until one gets approved out of fatigue. This family covers the run of 2021-2023 breaches, including Uber, EA, Caesars and Microsoft, that made this the defining enterprise social engineering pattern of its era.
In March 2022, LAPSUS$ (DEV-0537) leaked an archive it said held 37GB of Microsoft source code. Microsoft only confirmed that one account was compromised, with limited access and no customer code or data involved. It has never put a figure on the loss. A documented incident.
HAThe EA data breach began in June 2021, when hackers used a Slack session cookie they said cost $10 to get into Electronic Arts' Slack. Posing as an employee who'd lost a phone, they got IT support to issue an MFA token. They took game source code, including FIFA 21, and asked $28 million for it. EA said no player data was accessed. A documented incident.
HAThe Caesars breach began in August 2023, when someone called its outsourced IT help desk, said they were an employee, and got a password reset. Soon after, the Caesars Rewards database was stolen. Caesars reportedly paid about $15 million, but its SEC filing never puts a number on it. A documented incident, attributed to Scattered Spider.
MGM Resorts, Caesars Entertainment, and Jaguar Land Rover were all breached after an attacker called IT support and talked a help-desk agent into resetting credentials or approving access for someone who was not who they claimed to be.
Uber in 2022 was breached after a contractor was flooded with MFA push prompts and eventually approved one out of fatigue, EA Games suffered a Slack and MFA social engineering breach the year before, and the Microsoft LAPSUS$/DEV-0537 source-code intrusion followed the same push-fatigue and social engineering pattern.
The 2015 Ukraine power grid attack by Sandworm and BlackEnergy showed the same social engineering foothold techniques used against industrial control systems, while the FTC pretexting sweep against telephone record sellers showed regulators treating pretext-based access as a distinct enforcement priority.
Social Engineering Examples