--- id: CP-021 slug: pretexting-credible-authority-scenario lang: en title: Pretexting, or the art of the false pretext description: "A fake IT support person who calls or writes to get a password: how pretexting works and how to defuse it." canonical_url: https://startbrain.io/cyberpedia/en/articles/pretexting-credible-authority-scenario/ markdown_url: https://startbrain.io/cyberpedia/en/articles/pretexting-credible-authority-scenario.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Pretexting, or the art of the false pretext", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/pretexting-credible-authority-scenario/ (CC BY 4.0) wing: 1 theme: outsmart_social_engineering reflex: cr-040 schema: G5 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/pretexting-credible-authority-scenario/ fr: https://startbrain.io/cyberpedia/fr/articles/pretexting-scenario-autorite-credible/ de: https://startbrain.io/cyberpedia/de/articles/pretexting-glaubwuerdiges-autoritaetsszenario/ es: https://startbrain.io/cyberpedia/es/articles/pretexting-escenario-autoridad-creible/ sources: - "n": 1 title: Avoiding Social Engineering and Phishing Attacks publisher: CISA url: https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks published: "2021-02-01" accessed: "2026-11-03" - "n": 2 title: Phishing for Information, Technique T1598 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1598/ accessed: "2026-11-03" - "n": 3 title: "Phishing: Spearphishing Voice, Sub-technique T1566.004 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1566/004/ accessed: "2026-11-03" - "n": 4 title: "Phishing for Information: Spearphishing Service, Sub-technique T1598.001 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1598/001/ accessed: "2026-11-03" - "n": 5 title: Scattered Spider publisher: CISA url: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a published: "2023-11-16" accessed: "2026-11-03" - "n": 6 title: Octo Tempest crosses boundaries to facilitate extortion, encryption, and destruction publisher: Microsoft url: https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/ published: "2023-10-25" accessed: "2026-11-03" - "n": 7 title: Scattered Spider, Roasted 0ktapus, Octo Tempest, Storm-0875, UNC3944, Group G1015 | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/groups/G1015/ accessed: "2026-11-03" - "n": 8 title: "Phishing attacks: defending your organisation" publisher: NCSC (UK) url: https://www.ncsc.gov.uk/guidance/phishing published: "2018-02-05" accessed: "2026-11-03" --- # Pretexting, or the art of the false pretext A stranger calls, writes or sends a message, posing as someone entitled to ask questions: IT support, a supplier, a bank, a new colleague. The stranger does not need to hack anything if the person on the other end hands over a password, a code or internal information. CISA describes this pattern: the attacker may claim to be a new employee, a repair person or a researcher, offer false proof of identity, then cross-check the answers obtained [1]. The technique relies on a false pretext, hence its name, pretexting. MITRE places it among the techniques of information gathering through phishing: the goal is to make the victim reveal data, often credentials, rather than to make them run malicious software [2]. ## In 30 seconds - Where it happens: by phone [3], by text message [5], by Teams message [7] or by email [2]. - What the attacker wants: credentials or other usable information [2], sometimes a one-time code [2]. - The reflex: give nothing to the person who made contact and check their identity directly with the organisation they claim to represent [1]. - If it is already done: tell the right people in the company right away, and change the passwords that were disclosed [1]. ## Straight answers ### What is pretexting? It is a form of social engineering: the attacker uses human contact to obtain or compromise information about an organisation or its systems [1]. The pretext (a fault to repair, an account to verify, a payment to settle) gives a plausible reason to ask for something. ### Why does the message seem so credible? Because the attacker did their homework first. MITRE notes that these approaches reuse information from prior reconnaissance, for example on social networks or on the targeted company's websites, to build believable lures [4]. In the case of Scattered Spider, CISA cites information drawn from social media, open sources, commercial intelligence tools and database leaks [5]. ### Who is targeted? Everyone, but IT support especially. Microsoft observes that the Octo Tempest group often targets technical administrators, such as support and help desk staff, whose privileges allow them to open access to accounts [6]. ### What does the attacker ask for? The requests seen in the sources are concrete: credentials, a one-time code, a password reset, the transfer of a second authentication factor to a device the attacker controls, or the installation of a remote access tool [3][5][7]. ### What should you do if you already answered? CISA advises reporting the incident to the appropriate people in the organisation, including network administrators, who can watch for unusual activity, and changing the disclosed passwords without delay, on every account where the same password was used [1]. ## Inside the attacker's head The attacker starts by gathering names, job titles and procedures. A fake social media profile can serve as an entry point: MITRE describes fictitious accounts that offer job opportunities to employees, which gives a plausible reason to ask questions about departments, rules and the IT environment [4]. Employee identities can also come from earlier leaks: MITRE reports that Scattered Spider used information from past data breaches to find employee names to use in its manoeuvres [7]. Then comes the staging. An attacker who does not get enough information from one person approaches another in the same organisation and relies on the first answer to look legitimate [1]. Scattered Spider's calls often take place in several stages: the first ones are used to learn how the help desk handles a password reset, the later ones to collect the details specific to the targeted employee [5]. Finally, the pressure. MITRE points to posing as a trusted source and sending several messages that look urgent [2], as well as the sense of urgency or alarm created in the recipient in the case of voice phishing [3]. ## What you see on screen The forms observed in the sources are as follows. - A call from a supposed technician who asks you to install a remote maintenance tool. MITRE cites Scattered Spider calls posing as IT staff to push victims into downloading such a tool [3]. - A Microsoft Teams message from a fake internal support desk, recorded by MITRE for Scattered Spider [7]. - An email whose sender impersonates a third party, which can fool both the recipient and automated security tools [2]. - A message that invites you to call back a phone number, where the attacker tries to collect confidential information [2]. CISA also lists classic warning signs: a sender address close to that of a real company with a few characters changed or removed, a generic greeting, links whose address does not match the text, mistakes or an inconsistent layout, an unsolicited attachment with a false urgency [1]. These signs are not always enough: a well-written, well-researched request may contain none of them. Here is a neutralised illustration, described from the domain names CISA cites (the targeted company's name followed by "helpdesk" or a single sign-on service) [5]: ```text Illustration, neutralised address: company-name-helpdesk[.]invalid [Paraphrased message: the "support" asks you to log in on this site to verify the account.] ``` ## Under the hood Three mechanisms combine. First, information gathering (organisation chart, names, procedures), which supplies the backdrop of the pretext [4][5]. Second, identity impersonation: an employee, a technician or a new hire. Microsoft reports that Octo Tempest mimics the idiolect of the people it imitates on the phone, knows their personal data and has posed as new employees to blend into onboarding procedures [6]. Last, authority and urgency, which push people to answer fast. The telephone makes deception easier. CISA stresses that internet telephony makes it easy to spoof the caller's identifier, which feeds the public's misplaced trust in the security of the phone [1]. When the attacker poses as an employee to the support desk, the aim is to get a password reset or to have multifactor authentication transferred to a device the attacker controls [5]. Microsoft even describes cases where the attacker bypasses the procedure by using an already compromised manager's account to approve the requests [6]. Internal confirmations are therefore only worth something if the channel itself is safe. ## Case files ### Early 2022: Octo Tempest and SIM swaps According to Microsoft, the Octo Tempest group was first observed in early 2022. It targeted mobile telephony providers and business process outsourcing companies to trigger number ports, known as SIM swaps. In 2022, it profited from these intrusions by selling SIM swaps to other criminals and by taking over the accounts of very wealthy people to steal their cryptocurrency [6]. ### 25 October 2023: Microsoft describes Octo Tempest's methods In its post of 25 October 2023, Microsoft explains that this group calls an organisation's help desk to get a user's password reset or an authentication factor added [6]. Once it controls an employee's phone number, it can also start a self-service reset of the account [6]. ### 16 November 2023 and 29 July 2025: the joint advisory on Scattered Spider The joint advisory from CISA, the FBI and partner agencies was published on 16 November 2023, then updated on 21 November 2023 and on 29 July 2025 [5]. It describes a group that targets large companies and their outsourced IT help desks [5]. Its members posed as IT or support staff by call or text message to obtain credentials, and as employees to convince support to reset a password and transfer the second factor [5]. The advisory recommends phishing-resistant multifactor authentication, protected against notification bombing and SIM swapping [5]. ## What you do The reflex boils down to this: do not answer the person who made contact, verify through another channel. - Be wary of an unsolicited call, visit or message that asks questions about employees or the internal organisation. If the stranger claims to represent a legitimate organisation, check their identity directly with it [1]. - Do not give out information about yourself or the company, including its structure and networks, unless you are sure the person is entitled to know it [1]. - If you doubt an email request, contact the organisation directly, without using the contact details in the message or on the site linked to the request: look them up in earlier exchanges [1]. - Report the attempt, even if you gave nothing away. The UK NCSC recommends a culture where people report without fear of blame, because employees who dread punishment do not report their mistakes [8]. On the organisation's side, MITRE points out that users can be trained to spot and report these techniques, and to distrust callers by verifying their identity [3]. ## Sources 1. CISA, "Avoiding Social Engineering and Phishing Attacks", 1 February 2021. https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks (accessed 3 November 2026) 2. MITRE ATT&CK, "Phishing for Information, Technique T1598 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1598/ (accessed 3 November 2026) 3. MITRE ATT&CK, "Phishing: Spearphishing Voice, Sub-technique T1566.004 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1566/004/ (accessed 3 November 2026) 4. MITRE ATT&CK, "Phishing for Information: Spearphishing Service, Sub-technique T1598.001 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1598/001/ (accessed 3 November 2026) 5. CISA, "Scattered Spider", 16 November 2023. https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a (accessed 3 November 2026) 6. Microsoft, "Octo Tempest crosses boundaries to facilitate extortion, encryption, and destruction", 25 October 2023. https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/ (accessed 3 November 2026) 7. MITRE ATT&CK, "Scattered Spider, Roasted 0ktapus, Octo Tempest, Storm-0875, UNC3944, Group G1015 | MITRE ATT&CK®". https://attack.mitre.org/groups/G1015/ (accessed 3 November 2026) 8. NCSC (UK), "Phishing attacks: defending your organisation", 5 February 2018. https://www.ncsc.gov.uk/guidance/phishing (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/pretexting-credible-authority-scenario/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.