Social engineering attacks have become increasingly sophisticated, aided by AI tools that make it easier to create convincing messages, impersonate trusted individuals, and personalize attacks at scale. They’ve also become more frequent, with AI-driven phishing attacks surging 204% YoY according to cybersecurity firm Cofense.
While AI has undoubtedly advanced and scaled social engineering tactics, the true success of these campaigns can be traced back long before hackers even make contact with their target: reconnaissance. New LevelBlue SpiderLabs research found that a legitimate, public-facing Microsoft feature can be exploited as a source of this early-stage intelligence.
Microsoft’s Self-Service Password Reset (SSPR) portal reveals information about accounts without requiring authentication. These seemingly small pieces of identity information can provide attackers with valuable insight into who to target and how to tailor phishing or social engineering campaigns around them.
The Portal Problem
Microsoft’s SSPR portal is an authentic, trusted feature, designed to let users recover their accounts without calling the help desk. Instead, users can easily verify their identity on their own using a registered second factor such as an authenticator app, phone number, alternate email address, or other similar verification method.
The challenge is that the portal itself is publicly accessible, with no prior authentication required. It can also confirm information including whether an account exists and, when SSPR is enabled for that account, which SSPR verification methods are registered. When SSPR is disabled for standard users, differences in how the portal responds can also help attackers identify likely administrator accounts. Even when an organization disables SSPR for standard users, Microsoft keeps it enabled for administrators, creating a distinction that can signal which accounts have elevated access.
While these details don’t reveal an account’s complete MFA posture, they can still be valuable to attackers, enabling various stages of hacker campaigns:
Reconnaissance: Attackers can validate email lists from LinkedIn, company websites or data breaches, separating real accounts from dead ends.
Target Prioritization: Accounts exposing weaker SSPR verification methods can give attackers a clearer idea of where to focus their efforts, while the absence of visible methods may provide additional signals about an account’s security posture.
Privileged Account Identification: SSPR responses can help attackers spot likely admin accounts and prioritize higher-value targets.
Phishing/Vishing: Knowing a target’s verification method helps attackers tailor their approach, from SIM swaps and MFA fatigue to targeting secondary inboxes.
When Reconnaissance Meets Social Engineering
This research comes as social engineering already plays an outsized role in real-world intrusions.
According to LevelBlue SpiderLabs’ Q2 data, phishing was the initial intrusion vector in 65% of incidents observed by incident response teams. The same research found that MFA was defeated in every business email compromise case where it was deployed, illustrating that simply having MFA in place does not make an organization immune to modern identity-based attacks.
These findings underscore how attackers are adapting their techniques to the identity controls they encounter. The more attackers can learn during reconnaissance, the easier it becomes to adapt their techniques to the controls standing in their way. Instead of beginning a phishing campaign with little knowledge of the victim’s defenses, an attacker may be able to leverage Microsoft’s SSPR portal to enter the engagement knowing that an account exists and, in some cases, which verification method is likely to stand between them and access.
This shifts the defensive challenge: organizations can’t look at each exposure in isolation when attackers are piecing together information from multiple sources to build more targeted attacks.
The Path Forward
Reducing this risk starts with limiting what attackers can learn and strengthening the controls that stand in their way:
Strengthen Authentication Methods: Not all second factors are equal. Limit weaker SSPR options like alternate email and security questions where possible and require stronger verification methods. For privileged accounts, use phishing-resistant MFA such as FIDO2 or certificate-based authentication.
Limit SSPR Access: Scope SSPR to users who genuinely need it to reduce the number of accounts exposed to potential enumeration.
Monitor for Enumeration: Watch Entra Audit Logs for unusual SSPR activity, such as bursts of requests across multiple accounts or repeated failures without completed password resets.
Protect Privileged Accounts: Apply stronger authentication and Conditional Access policies to admin accounts so identifying a privileged user doesn’t provide an easy path to compromise.
Treat Identity Workflows as Attack Surface: Evaluate password reset and account recovery tools not just for direct vulnerabilities, but for what they may reveal about users, privileges and security controls.
The broader lesson extends beyond SSPR. As attackers use AI to make social engineering more convincing, organizations also need to pay attention to the intelligence attackers can gather before an attack begins. Trusted, legitimate identity systems can become part of that reconnaissance even when they aren’t directly compromised. What may look like small pieces of information can quickly become a roadmap for a targeted attack. For defenders, that means evaluating identity infrastructure not only for the vulnerabilities attackers can exploit, but also for the intelligence they can collect.
_______
About Matthew Coady
Matthew Coady is a Senior Security Consultant at LevelBlue, where he joined in September 2026 after more than six years in offensive security consulting. Before LevelBlue, he spent four years as a Security Consultant at Pen Test Partners. He began his career at Fidus Information Security in 2020. His work centres on penetration testing and adversary simulation, with particular depth in red teaming and cloud security.
Join our LinkedIn group Information Security Community!
——————————————————-
Click Here For The Original Source.
