# Trust-Based Fraud: Help Desk Social Engineering, Brand Impersonation and AI Deepfakes Abuse Established Customer Relationships

> Dark Reading reports that fraudsters increasingly bypass malware by calling help desks, impersonating trusted brands and existing customer accounts, and using AI-powered deepfakes, text spoofing and compromised credentials. Account login accounted for 53% of suspected digital fraud in H1 2026, and help-desk calls to obtain MFA codes are described as 'the most effective zero-day of 2026'.

- **Published:** 2026-10-23T21:39:23Z
- **Last reviewed:** 2026-10-23T21:39:23Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4312
- **ID:** TL-2026-4312
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 2 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This record documents a trend-level social-engineering and identity-fraud threat rather than a single product vulnerability or named campaign. The primary source (Dark Reading, 'Trust Is Not What It Seems — And Fraudsters Are Counting on It') could not be retrieved directly (HTTP 403); the facts below come from the source summary captured during hunting and are corroborated, where noted, by independent public reporting on the same tradecraft.

Reported tradecraft: threat actors increasingly avoid malware and instead abuse established trust relationships. They call help desks and contact centers while impersonating existing customers or employees, impersonate trusted brands, use AI-powered deepfakes (voice/video), spoof text messages, and use compromised credentials to log in to existing accounts. Account login was reported as 53% of suspected digital fraud in H1 2026, and help-desk calls used to obtain MFA codes were characterized as 'the most effective zero-day of 2026' because the target is a human process rather than software.

Corroborating context: CISA/FBI advisory AA23-320A (initial release 2023-11-16, updated 2025-07-29) documents the same help-desk pattern in Scattered Spider operations: impersonating employees by phone or SMS to obtain password resets and transfer MFA to attacker-controlled devices, plus SIM swapping and MFA fatigue. Public reporting on the MGM Resorts incident (September 2023) and the Marks & Spencer incident (April 2025) describes impersonation of an employee, or of an employee via a third party, to obtain a password/MFA reset. Infosecurity Europe guidance (2025-08-26) adds that attackers persuade help-desk staff to register unauthorized MFA devices, target administrator and executive accounts, and abuse legitimate RMM and file-sync tools. Darktrace's Mid-Year Threat Update 2026 (2026-08-03) frames trust as the primary attack surface, with compromised accounts used to operate inside trusted SaaS environments. These items are context for the technique, not evidence that one actor is behind the activity in the Dark Reading article.

No CVE, named actor, malware family, or network IOC is attributed in the primary source. IOCs recorded here are behavioral indicators of the abuse pattern. Defensive recommendations summarized in the source: audit CRM entry points (OAuth apps, integrations, guest/portal users, API keys), scripted identity verification for credential and MFA resets, callback to the number of record, and manager approval for privileged or MFA resets.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1598.004 Phishing for Information: Spearphishing Voice
- T1566.004 Phishing: Spearphishing Voice
- T1566 Phishing
- T1078 Valid Accounts
- T1078.004 Valid Accounts: Cloud Accounts
- T1199 Trusted Relationship
- T1684.001 Impersonation
- T1111 Multi-Factor Authentication Interception
- T1621 Multi-Factor Authentication Request Generation
- T1556.006 Modify Authentication Process: Multi-Factor Authentication
- T1098.005 Account Manipulation: Device Registration

## Sources

- [Trust Is Not What It Seems — And Fraudsters Are Counting on It (Dark Reading)](https://www.darkreading.com/cyber-risk/trust-is-not-what-it-seems-and-fraudsters-are-counting-on-it)
- [CISA/FBI Advisory AA23-320A: Scattered Spider](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a)
- [Darktrace Mid-Year Threat Update 2026: Why Trust Is the New Attack Surface](https://www.darktrace.com/de/blog/why-trust-is-the-new-attack-surface-darktraces-mid-year-threat-update-2026)
- [How to Defend Against IT Helpdesk Social Engineering Attacks (Infosecurity Europe)](https://www.infosecurityeurope.com/en-gb/blog/threat-vectors/defend-against-it-helpdesk-attacks.html)
- [Your Help Desk Is the New Perimeter: What MGM, M&S, and Scattered Spider Taught Every IT Team](https://guptadeepak.com/help-desk-is-the-new-perimeter/)
- [CISA, FBI issue alert for ongoing Scattered Spider activity (TechTarget)](https://www.techtarget.com/cybersecurity/news/366559974/CISA-FBI-issue-alert-for-ongoing-Scattered-Spider-activity)
- [Fraud Alert: Why Trust, Not Technology, Is Now the Cybercriminal's Favourite Weapon (Moneylife)](https://www.moneylife.in/article/fraud-alert-why-trust-not-technology-is-now-the-cybercriminals-favourite-weapon/81229.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4312