Password resets are one of the easiest ways for attackers to bypass security controls. Specops Software shows how helpdesk social engineering turns a seemingly legitimate reset request into full account compromise. [...]

https://www.bleepingcomputer.com/news/security/regular-password-resets-arent-as-safe-as-you-think/