4 ms·

So cookie gets them into Slack. But how were they able to get into the network, spin up a vm and connect to p4? That doesn't happen with a cookie and MFA toke

So cookie gets them into Slack. But how were they able to get into the network, spin up a vm and connect to p4? That doesn't happen with a cookie and MFA token. They either had a username/password combo already, or support also allowed them to reset the compromised users password (ex through a one time link to set a new pw, or perhaps more egregiously "here is your new password: welcome2EA". A video call and a few questions could have stopped this. Or a password reset flow that requires some sort of previous information. Would love more details here.

delive 5y ago
This is where I'm confused as well and yours is the first comment mentioning it. A more plausible scenario is that IT reset their AD/IDP password because of the lost device and gave them the temp pw over slack + some MFA token.
rmac 5y ago
They said they lost their phone, which means they could have told the IT person they also lost access to email "my laptop email logged me out!, Our game is already behind schedule I need to get online now before I get fired" Remember: a good phish will push the target to make quick and poor decisions, by appealing to various emotions.