Failure pattern · 20 documented incidents

Weak or phishable authentication on a privileged path

A password, an SMS code or a help-desk reset is all that stands between an attacker and admin access.

See it happen

Watch how this failure unfolds, then switch to the same situation with the safeguard in place. Click any step to replay it.

Scroll the diagram sideways to see every system.

12 / 12 s

A phone call was the only barrier to admin.

What goes wrong:

  1. An attacker calls the help desk, pretending to be an employee.
  2. The help desk resets the password and the SMS code over the phone.
  3. The attacker signs in to the admin console.
  4. A phone call was the only barrier to admin.

With the safeguard:

  1. An attacker calls the help desk, pretending to be an employee.
  2. Resets require verified identity, so the help desk checks with the real person.
  3. Admin sign-in needs a passkey on the employee’s own device, so the attempt fails.
  4. The real employee reports the attempt.

What it is

A password, an SMS code or a friendly phone call to the help desk is all that stands between an attacker and admin access. Attackers don’t need to break in when they can be let in.

How it happens

  • Privileged accounts use passwords or SMS codes that can be phished
  • The help desk can reset MFA based on a phone call
  • Remote access portals and contractor accounts have weaker login rules

What it causes

  • Attackers with admin access to core systems
  • Ransomware and data theft across the company
  • Customer accounts taken over through internal tools

Warning signs

  • MFA resets requested for privileged users
  • Push-notification floods (MFA fatigue)
  • Admin logins from new devices or locations

How to prevent it

Require phishing-resistant MFA on every privileged path. Use passkeys or hardware keys for admins, vendors and support tools, verify identity out of band before credential or MFA resets, and keep sessions short-lived and device-bound.

  • Privileged access requires phishing-resistant MFA, such as passkeys or security keys
  • Help-desk resets for privileged accounts need verified identity, not just a convincing call
  • Remote access and contractor accounts follow the same login rules as everyone else

Key ideas:Phishing-resistant MFA

Check your system against the full launch checklist

Real incidents with this pattern

Documented incidents first. Each links to its public source.

Open in the database
Documented incidentIncident 2025-08-26AI agent

GitHub Actions injection leaks Nx's npm token; malicious packages use local AI coding tools to hunt for secrets (2025)

A pull-request title validation workflow used pullrequesttarget, which runs with repository secrets, and echoed the unsanitized PR title, creating an injection point; the workflow's token also had read/write permissions.

Safeguard: Never run untrusted pull-request input with secrets

Privileged action without an enforceable approval gatenx.dev
Documented incidentDisclosed 2022-09-16

MFA fatigue against a contractor gives an attacker access to Uber's internal tools (2022)

An attacker likely bought a contractor's corporate password on the dark web after malware infected the contractor's personal device, then repeatedly sent two-factor approval requests until the contractor accepted one.

Safeguard: Use phishing- and fatigue-resistant MFA

Weak or phishable authentication on a privileged pathuber.com
Documented incidentIncident 2022-08-04

SMS phishing of employees leads to compromise of Twilio customer accounts (2022)

Attackers used SMS phishing to fool some Twilio employees into giving up credentials, then used them to access internal systems and information about a limited number of customer accounts.

Safeguard: Use phishing-resistant MFA for employees

Weak or phishable authentication on a privileged pathtwilio.com
176 security advisories and illustrative scenarios with this pattern
Incident disclosureDisclosed 2025-05-15

Coinbase Global, Inc. discloses a cybersecurity incident (SEC 8-K, May 2025)

On May 11, 2025, Coinbase, Inc., a subsidiary of Coinbase Global, Inc. (“Coinbase” or the “Company”), received an email communication from an unknown threat actor claiming to have obtained information about certain…

Weak or phishable authentication on a privileged pathsec.gov
Security advisory2026-10-16

Software component issue could expose accounts or credentials

A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials…

Weak or phishable authentication on a privileged pathnvd.nist.gov
Security advisory2026-10-16

Software component issue could grant elevated privileges

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the startcomms…

Weak or phishable authentication on a privileged pathnvd.nist.gov
Security advisory2026-10-16

Software component issue could expose accounts or credentials

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the 'woofsettings[woofstat][serveroptions]'…

Weak or phishable authentication on a privileged pathnvd.nist.gov

In the standards

CollectSEA's mapping; not an official determination by the standards bodies.