A coordinated identity attack against a wireless services account combined social engineering, SIM swapping, OTP abuse, and session hijacking, exposing how one-time authentication can fail against determined adversaries. The incident shows why organizations must continuously evaluate identity risk across the full session and protect high-risk actions with stronger verification. #ScatteredSpider #ShinyHunters #SIMSwapping
Keypoints
- Attackers used a trusted phone call to gain the victim’s confidence.
- SMS OTPs were abused to approve an authentication request.
- A carrier account passcode became the final credential for takeover.
- Concurrent login activity revealed session hijacking in progress.
- SIM swaps and account changes required immediate incident response and stronger continuous identity checks.