Fluent English-speaking callers, often working “evening shifts” that coincide with Western office hours, posed as CFOs or IT staff to persuade help-desk agents to reset multi-factor authentication (MFA) tokens, providing Evilginx with the final session cookie needed for lateral movement. Scattered Spider burst onto the cybersecurity stage in early 2022 as little more than a SIM-swapping crew, but by mid-2025 it had pivoted into a full-scale, financially motivated threat group leveraging advanced phishing toolkits to breach some of the world’s most technology-dependent firms. Once the session cookie is harvested, Scattered Spider scripts an API call to Okta’s /api/v1/sessions/me endpoint to confirm validity before pivoting into VPN or SaaS consoles. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. During the past year, investigators have connected Scattered Spider to a string of coordinated intrusions against managed service providers (MSPs) and IT contractors, capitalizing on their “one-to-many” access to customer networks. May 2025 marked a turning point, as the breaches at UK household names such as Marks & Spencer and Co-op—traced to compromised credentials at Tata Consultancy Services—revealed the depth of Scattered Spider’s social-engineering playbook. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. ReliaQuest analysts identified that 81 percent of the gang’s registered domains impersonated technology vendors, a tactic designed to lure system administrators and executives into Evilginx-powered credential traps. The result has been a wave of follow-on ransomware, double-extortion schemes, and data-theft incidents that forced retailers and SaaS providers on both sides of the Atlantic to reset thousands of privileged accounts. Unlike classic phishing sites that merely collect usernames and passwords, Evilginx operates as a transparent reverse proxy that intercepts every HTTP transaction between victim and legitimate identity provider. Tushar is a Cyber security content editor with a passion for creating captivating and informative content.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 30 Jun 2025 10:05:09 +0000