Credential Reset Followed by Rapid MFA Re-Registration (Vishing)

Arnold Chan@slaz

•updated Sep 8, 2026•0•0•0

Detects a suspicious sequence of events where a user's password is changed or reset by an administrator (or help-desk role) followed within a short time window by that same user registering a new MFA device, potentially indicating a vishing-based account takeover attack (e.g., PREY-0058/UNC6671).