Cyberpediaby Brain
ENDEFR

Pretexting, or the art of the false pretext

A fake IT support person who calls or writes to get a password: how pretexting works and how to defuse it.

In 30 seconds

Where it happens
By phone3, by text message5, by Teams message7 or by email2.
What the attacker wants
Credentials or other usable information2, sometimes a one-time code2.
The reflex
Give nothing to the person who made contact and check their identity directly with the organisation they claim to represent1.
If it is already done
Tell the right people in the company right away, and change the passwords that were disclosed1.

What it is

A stranger calls, writes or sends a message, posing as someone entitled to ask questions: IT support, a supplier, a bank, a new colleague. The stranger does not need to hack anything if the person on the other end hands over a password, a code or internal information. CISA describes this pattern: the attacker may claim to be a new employee, a repair person or a researcher, offer false proof of identity, then cross-check the answers obtained1.

The technique relies on a false pretext, hence its name, pretexting. MITRE places it among the techniques of information gathering through phishing: the goal is to make the victim reveal data, often credentials, rather than to make them run malicious software2.

Straight answers

What is pretexting?

It is a form of social engineering: the attacker uses human contact to obtain or compromise information about an organisation or its systems1. The pretext (a fault to repair, an account to verify, a payment to settle) gives a plausible reason to ask for something.

Why does the message seem so credible?

Because the attacker did their homework first. MITRE notes that these approaches reuse information from prior reconnaissance, for example on social networks or on the targeted company's websites, to build believable lures4. In the case of Scattered Spider, CISA cites information drawn from social media, open sources, commercial intelligence tools and database leaks5.

Who is targeted?

Everyone, but IT support especially. Microsoft observes that the Octo Tempest group often targets technical administrators, such as support and help desk staff, whose privileges allow them to open access to accounts6.

What does the attacker ask for?

The requests seen in the sources are concrete: credentials, a one-time code, a password reset, the transfer of a second authentication factor to a device the attacker controls, or the installation of a remote access tool357.

What should you do if you already answered?

CISA advises reporting the incident to the appropriate people in the organisation, including network administrators, who can watch for unusual activity, and changing the disclosed passwords without delay, on every account where the same password was used1.

1Inside the attacker's head1 min

The attacker starts by gathering names, job titles and procedures. A fake social media profile can serve as an entry point: MITRE describes fictitious accounts that offer job opportunities to employees, which gives a plausible reason to ask questions about departments, rules and the IT environment4. Employee identities can also come from earlier leaks: MITRE reports that Scattered Spider used information from past data breaches to find employee names to use in its manoeuvres7.

Then comes the staging. An attacker who does not get enough information from one person approaches another in the same organisation and relies on the first answer to look legitimate1. Scattered Spider's calls often take place in several stages: the first ones are used to learn how the help desk handles a password reset, the later ones to collect the details specific to the targeted employee5.

Finally, the pressure. MITRE points to posing as a trusted source and sending several messages that look urgent2, as well as the sense of urgency or alarm created in the recipient in the case of voice phishing3.

2What you see on screen1 min

The forms observed in the sources are as follows.

  • A call from a supposed technician who asks you to install a remote maintenance tool. MITRE cites Scattered Spider calls posing as IT staff to push victims into downloading such a tool3.
  • A Microsoft Teams message from a fake internal support desk, recorded by MITRE for Scattered Spider7.
  • An email whose sender impersonates a third party, which can fool both the recipient and automated security tools2.
  • A message that invites you to call back a phone number, where the attacker tries to collect confidential information2.

CISA also lists classic warning signs: a sender address close to that of a real company with a few characters changed or removed, a generic greeting, links whose address does not match the text, mistakes or an inconsistent layout, an unsolicited attachment with a false urgency1. These signs are not always enough: a well-written, well-researched request may contain none of them.

Here is a neutralised illustration, described from the domain names CISA cites (the targeted company's name followed by "helpdesk" or a single sign-on service)5:

Excerpt
Illustration, neutralised address:
company-name-helpdesk[.]invalid
[Paraphrased message: the "support" asks you to log in on this site to verify the account.]
3Under the hoodIT teams1 min

Three mechanisms combine. First, information gathering (organisation chart, names, procedures), which supplies the backdrop of the pretext45. Second, identity impersonation: an employee, a technician or a new hire. Microsoft reports that Octo Tempest mimics the idiolect of the people it imitates on the phone, knows their personal data and has posed as new employees to blend into onboarding procedures6. Last, authority and urgency, which push people to answer fast.

The telephone makes deception easier. CISA stresses that internet telephony makes it easy to spoof the caller's identifier, which feeds the public's misplaced trust in the security of the phone1.

When the attacker poses as an employee to the support desk, the aim is to get a password reset or to have multifactor authentication transferred to a device the attacker controls5. Microsoft even describes cases where the attacker bypasses the procedure by using an already compromised manager's account to approve the requests6. Internal confirmations are therefore only worth something if the channel itself is safe.

4Case filesReal cases1 min

Early 2022: Octo Tempest and SIM swaps

According to Microsoft, the Octo Tempest group was first observed in early 2022. It targeted mobile telephony providers and business process outsourcing companies to trigger number ports, known as SIM swaps. In 2022, it profited from these intrusions by selling SIM swaps to other criminals and by taking over the accounts of very wealthy people to steal their cryptocurrency6.

25 October 2023: Microsoft describes Octo Tempest's methods

In its post of 25 October 2023, Microsoft explains that this group calls an organisation's help desk to get a user's password reset or an authentication factor added6. Once it controls an employee's phone number, it can also start a self-service reset of the account6.

16 November 2023 and 29 July 2025: the joint advisory on Scattered Spider

The joint advisory from CISA, the FBI and partner agencies was published on 16 November 2023, then updated on 21 November 2023 and on 29 July 20255. It describes a group that targets large companies and their outsourced IT help desks5. Its members posed as IT or support staff by call or text message to obtain credentials, and as employees to convince support to reset a password and transfer the second factor5. The advisory recommends phishing-resistant multifactor authentication, protected against notification bombing and SIM swapping5.

5What you do1 min

The reflex boils down to this: do not answer the person who made contact, verify through another channel.

  • Be wary of an unsolicited call, visit or message that asks questions about employees or the internal organisation. If the stranger claims to represent a legitimate organisation, check their identity directly with it1.
  • Do not give out information about yourself or the company, including its structure and networks, unless you are sure the person is entitled to know it1.
  • If you doubt an email request, contact the organisation directly, without using the contact details in the message or on the site linked to the request: look them up in earlier exchanges1.
  • Report the attempt, even if you gave nothing away. The UK NCSC recommends a culture where people report without fear of blame, because employees who dread punishment do not report their mistakes8.

On the organisation's side, MITRE points out that users can be trained to spot and report these techniques, and to distrust callers by verifying their identity3.

Fact sheet

Identifier
CP-021
Wing
1. Attacks and techniques
Brain skill
Outsmarting Social Engineering (outsmart_social_engineering)
Brain reflex
cr-040
Diagram
G5 · Employee Decision Tree
Languages
de, en, fr
Sources
8 sources checked on 3 November 2026
Sources8 sources
  1. CISA, “Avoiding Social Engineering and Phishing Attacks”, 1 February 2021. https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks (accessed 3 November 2026)
  2. MITRE ATT&CK, “Phishing for Information, Technique T1598 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1598/ (accessed 3 November 2026)
  3. MITRE ATT&CK, “Phishing: Spearphishing Voice, Sub-technique T1566.004 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1566/004/ (accessed 3 November 2026)
  4. MITRE ATT&CK, “Phishing for Information: Spearphishing Service, Sub-technique T1598.001 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1598/001/ (accessed 3 November 2026)
  5. CISA, “Scattered Spider”, 16 November 2023. https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a (accessed 3 November 2026)
  6. Microsoft, “Octo Tempest crosses boundaries to facilitate extortion, encryption, and destruction”, 25 October 2023. https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/ (accessed 3 November 2026)
  7. MITRE ATT&CK, “Scattered Spider, Roasted 0ktapus, Octo Tempest, Storm-0875, UNC3944, Group G1015 | MITRE ATT&CK®”. https://attack.mitre.org/groups/G1015/ (accessed 3 November 2026)
  8. NCSC (UK), “Phishing attacks: defending your organisation”, 5 February 2018. https://www.ncsc.gov.uk/guidance/phishing (accessed 3 November 2026)

Cite this article

Brain, “Pretexting, or the art of the false pretext”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/pretexting-credible-authority-scenario/

BibTeX 
@misc{brain_cp021_en_2026,
  author = {Brain},
  title = {Pretexting, or the art of the false pretext},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/pretexting-credible-authority-scenario/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence