Scattered Spider Returns: Retail & Hospitality Firms Hit with Advanced Social Engineering
The notorious Scattered Spider threat group — responsible for the 2023 MGM Resorts and Caesars Entertainment breaches — has resumed operations targeting US retail and hospitality companies using AI-enhanced vishing and help desk impersonation attacks.
Who Is Scattered Spider
Scattered Spider (also tracked as UNC3944, Octo Tempest, and Starfraud) is a loosely organized cybercriminal group primarily composed of English-speaking members, many believed to be based in the US and UK. The group gained international notoriety in 2023 when they breached MGM Resorts International and Caesars Entertainment using social engineering attacks against IT help desks, causing hundreds of millions of dollars in damages. Following a period of reduced activity after several arrests in late 2024, CrowdStrike and the FBI confirmed in April 2026 that the group has reconstituted and resumed targeting US organizations, with a particular focus on retail and hospitality companies.
How the Attacks Work
Scattered Spider's signature technique is help desk social engineering. Attackers call an organization's IT help desk posing as a new employee, a remote worker locked out of their account, or even a senior executive. Using information gathered from LinkedIn, company websites, and data broker sites, they construct convincing backstories and answer security questions correctly. They then pressure help desk staff to reset MFA, add a new authenticator device, or provide temporary access credentials. In 2026, the group has enhanced their attacks with AI-generated voice cloning to impersonate specific employees, making the calls even more convincing. Once they gain initial access, they move quickly to establish persistence, exfiltrate data, and in some cases deploy ransomware.
Recent Victims and Tactics
CrowdStrike's April 2026 threat report identified at least 11 confirmed Scattered Spider intrusions in Q1 2026, targeting retail chains, hotel groups, and restaurant franchises. In several cases, attackers successfully convinced help desk staff to enroll a new authenticator app on a victim's account, bypassing MFA entirely. The group is also using SIM swapping — bribing or social engineering mobile carrier employees to transfer a victim's phone number to an attacker-controlled SIM — to intercept SMS-based MFA codes. Once inside, attackers have been observed accessing point-of-sale system credentials, customer loyalty program databases, and payment processing systems.
Defending Against Social Engineering at Scale
The most effective defense against Scattered Spider is a strict identity verification policy for all privileged account changes. Implement a rule that no MFA reset, password change, or new device enrollment can be performed based solely on a phone call — require the employee to verify their identity through a secondary channel such as a video call with their manager or an in-person visit to IT. Upgrade from SMS-based MFA to phishing-resistant FIDO2 authenticators or passkeys — these cannot be bypassed by SIM swapping or vishing. Implement conditional access policies that flag unusual login patterns such as new device enrollments from unexpected locations. Conduct regular social engineering awareness training that specifically covers vishing and help desk impersonation scenarios.
What Segler.Net Recommends
We strongly recommend that all San Antonio businesses — especially those in retail, hospitality, and professional services — review their help desk verification procedures immediately. If your IT support is handled by an internal team or a managed service provider, ensure they have a documented identity verification policy that does not rely solely on caller-provided information. Consider implementing a privileged access management (PAM) solution that requires multi-party approval for sensitive account changes. Contact Segler.Net to schedule a social engineering awareness training session for your staff and a review of your identity verification procedures.
- Train your help desk staff to never reset MFA or passwords based solely on a phone call — require in-person or video verification
- Implement a callback verification policy using a known number before any privileged account changes
- Enable phishing-resistant MFA (FIDO2/passkeys) — SMS and voice OTP can be bypassed by Scattered Spider
- Monitor for unusual identity provider activity including bulk MFA resets or new device enrollments
- Brief all employees on vishing tactics — attackers impersonate new hires, executives, and IT staff convincingly
Need Help With This Threat?
Our San Antonio security team can assess your exposure, apply patches, and protect your business before attackers strike.
Stay ahead of the next threat
Get weekly security alerts — breaches, patch updates, compliance news, and threat intel — delivered free to your inbox every week.