harbor-ato — help-desk vishing + MFA-reset takeover
Harbor Point Credit Union VP Member Services mvaldez@harborpointcu.org was taken over after a password spray, Okta MFA push fatigue, a social-engineered help-desk MFA/password reset, and a hidden external mailbox forward to harbor.archive@proton.me. A SIM-swap on the corporate line corroborates the timeline. Fully synthetic.
what this proves
- every primary engine produces deterministic, fixture-locked output — verified by
npm run check:flagship(728/728 fleet · 8 for this scenario). - every output is generated 100% locally in your browser — export IdP and audit logs, never upload tenant data.
- password spray, SIM swap ICCID change, MFA push fatigue, password reset, and hidden external mailbox forward surface without uploading evidence.
primary engines locked to this fixture
build the case binder
runs all eight primary engines on the synthetic evidence zip and opens a self-contained html binder. uses the default binder renderer for ato — no upload.
runs all 8 primary engines locally on the synthetic evidence zip · opens a self-contained html binder · no upload
download the synthetic evidence
MIT-licensed, fully synthetic. includes Okta system log, unified audit log, mailbox rules export, security evt spray csv, browser session dump, and carrier SIM swap log.
built deterministically from scripts/fixtures/build-harbor-ato.mjs. seed: harbor-ato:v1.
methodology
ato is spray → IdP → SIM swap → UAL → rules → endpoint creds. walk password spray detector → okta log analyzer → sim swap artifact detector → audit log parsers → mail rule parser → credential artifact scanner. read the full account takeover (ATO) guide →
after the playbook
run each primary locally — or export findings from the binder — then drop every csv/json into fatcousin-multi-tool-super-timeline-correlator. one timestamp-sorted timeline across password spray, SIM swap, MFA fatigue, password reset, and hidden mailbox forward — still zero upload.