Scattered Spider, tracked across the industry under names including UNC3944, Octo Tempest, Muddled Libra, and Scatter Swine, is one of the most heavily reported intrusion clusters of recent years. What makes it notable is not novel malware, but the opposite: it barely needs any. The publicly documented playbook is a study in identity-first attacks, where a convincing phone call and a compromised second factor do the work an exploit used to.

Publicly reported Scattered Spider intrusions tend to follow a recognizable chain. None of the individual steps are exotic, and that is the point, the danger is how cleanly they connect, and how often the weakest link is a human process rather than a patchable bug. The walkthrough below is drawn from public threat reporting on the group's tactics, not from any one incident.

1. Help-desk social engineering

The pattern reported again and again starts on the phone. An attacker calls the IT help desk posing as an employee, often armed with personal details harvested from breaches, social media, or prior phishing, and asks for a password reset or, more usefully, an MFA reset or a new device enrollment. Where a help desk verifies identity with details that are themselves easy to look up (employee ID, manager name, date of birth), the impersonation succeeds and the caller walks away with a working account.

2. SIM swapping

When a second factor is tied to a phone number, the number itself becomes the target. In a SIM swap, the attacker convinces (or bribes) a mobile carrier to port a victim's number onto a SIM they control, then quietly receives the SMS one-time codes and voice-call verifications meant for the real user. Any control that leans on "we texted you a code" collapses the moment the number moves.

3. MFA fatigue and bypass

Push-based MFA is defeated two ways in the public reporting. The blunt one is MFA fatigue, spamming a user with approval prompts until an exhausted or confused person taps "approve." The subtler one skips the user entirely: having socially engineered the help desk, the attacker simply re-enrolls MFA on their own device. Adversary-in-the-middle phishing kits add a third path, proxying a real login to capture the session token after MFA succeeds, so the stolen session sails past the second factor entirely.

4. Breaking the chain

Each link in this chain has a well-understood control that weakens it. The goal is not a single silver bullet but denying the attacker any easy pivot:

  • Harden help-desk verification. Never reset a password or MFA method on a caller's say-so alone. Require verification that cannot be socially engineered, a call-back to a number of record, manager or in-person confirmation, video with government ID, or a one-time code delivered through a separate, already-trusted channel.
  • Move to phishing-resistant MFA. FIDO2 security keys and passkeys bind the credential to the origin and the device, so there is nothing to read aloud, forward, or replay, which is what defeats both push fatigue and adversary-in-the-middle proxying.
  • Turn on number matching. If push MFA stays in play, number-matching and additional context (app, location) kill the blind one-tap approval that MFA-fatigue attacks depend on.
  • Reduce SIM-swap exposure. Stop using SMS and voice as authentication or account-recovery factors, and work with carriers on port-out locks and number-transfer protections for high-value accounts.
  • Monitor identity signals. Alert on the tells of this chain: new-device MFA enrollment, changes to MFA methods, impossible-travel sign-ins, and account resets initiated shortly before an unfamiliar login.

A conceptual detection captures the shape of the attack rather than any single tool:

ALERT WHEN  help-desk-initiated MFA reset
  FOLLOWED BY  new device enrollment
  FROM  an unfamiliar network or geography
→ hold the session for verification; don't trust it by default

The takeaway

Scattered Spider's edge is that it treats identity as the perimeter, and most organizations still guard the network far more carefully than the help-desk script. The controls that break the chain are known and available today; the work is making sure your recovery and enrollment flows actually enforce them under pressure.

That last part is testable. OverWatch Labs can pressure-test exactly this chain under controlled rules of engagement, probing help-desk verification, MFA enrollment, and account-recovery flows the way a social engineer would, so you find the weak link before someone else does.