The Ghost Session
“Retired accounts don’t log in. Someone makes them.”
10:06 AM — MSDCorp Executive Containment Room
Nobody spoke.
Daniel Mercer’s archived credential was still active.
Last login: Two days ago.
Origin: Executive Network Segment.
Leo stood still, staring at the screen.
Rolex replayed the authentication session.
“It’s clean,” he said.
Victor frowned.
“What does that mean?”
Rolex zoomed into the token chain.
“It means whoever used it knew exactly how to avoid detection.”
That was worse.
This wasn’t random access.
This was deliberate.
Precise.
Familiar.
10:18 AM
Ethan reviewed Mercer’s original federation design.
His eyes widened.
“There’s another inheritance path.”
Leo looked up.
“Another?”
Ethan nodded.
“Mercer built a fallback trust bridge between executive systems and acquisition systems.”
Victor stepped forward.
“Why?”
Ethan answered quietly.
“For business continuity.”
Leo stared at him.
“Business continuity built without security continuity becomes breach continuity.”
Nobody argued.
Because it was true.
10:34 AM
Rolex expanded the ghost session.
Three actions:
- Board-level acquisition trust map accessed
- Executive meeting notes downloaded
- Internal incident reports viewed
Then the final action.
One secure message sent.
Recipient: UNKNOWN
Serena froze.
“That means whoever’s using Mercer’s account is watching us in real time.”
Leo looked at Rolex.
“How close?”
Rolex answered:
“Close enough to know what we know.”
Unknown Location
The terminal illuminated.
A message appeared.
PHASE FOUR CONFIRMED
RESPONSE PATTERNS PREDICTABLE
Raze reviewed MSDCorp’s containment moves.
They were moving exactly as expected.
That was the power of trust.
Not access.
Predictability.
He typed:
“Fear makes organizations reveal more than attackers ever steal.”
Send.
11:02 AM
Rolex found something buried in Mercer’s archived communications.
A private encrypted note.
Sent six months before retirement.
To Victor Kane.
Subject: Permanent Exception Approval
Victor’s face drained.
Leo looked at him.
“You knew.”
Victor hesitated.
“It was operationally necessary.”
Leo stepped forward.
“Every operational shortcut becomes someone else’s breach path.”
The room tightened.
Because now the ghost wasn’t just Mercer.
It was decision-making.
11:24 AM
A new alert.
LIVE SESSION ACTIVE
Mercer’s credential.
Right now.
Inside MSDCorp.
Rolex looked at Leo.
“He’s here.”
Leo’s voice dropped.
“No.”
He stared at the screen.
“Someone wants us to think Mercer is the ghost.”
And that changed everything.
Because ghosts didn’t log in twice.
People did.
END OF EPISODE 6
Mercer’s account is active again.
Victor may know more than he admits.
And someone inside MSDCorp is shaping the investigation.
Who is behind the ghost session?
- Victor Kane
- Daniel Mercer
- Corporate Strategy Division
- Someone inside Executive Operations
- Someone Rolex hasn’t seen yet
Choose carefully.
Because ghosts don’t move.
People do.
