Fake IT help desk callers got by on little more than names and email addresses

Attackers posing as IT help desk staff contacted employees by phone, email and Microsoft Teams in the third quarter of 2026 and talked them into opening remote access sessions, Cisco Talos Incident Response (Talos IR) found across several engagements. In one case, that access ended in ransomware.

They knew names and email addresses

“The attackers appeared to know employee names and email addresses, as they contacted users directly by email and Teams and used identities that mimicked legitimate company help desk personnel,” Aliza Johnson, a researcher at Cisco Talos, told Help Net Security.

“They likely had broad, generic knowledge of how IT support interactions typically work as they successfully guided victims into Teams sessions and remote access and showed familiarity with common enterprise platforms like Quick Assist; however, there is no clear evidence of deep company- or victim-specific profiling beyond basic identity and contact information,” she said.

The targets were not limited to senior or technical staff. “The contacted victims varied both across organizations and within the same organization, suggesting the actors were primarily seeking any susceptible user for initial access rather than targeting specific individuals for privileged or specialized access,” Johnson said. Protections built around administrators and executives would have missed many of the people these attackers reached.

“Some of these attacks appear opportunistic. In one case, the victim called a fake IT support number shown in a generic browser-based scam pop-up that did not appear to spoof the victim organization, and later granted the adversary remote access. In another, the attacker launched two phishing waves, likely expecting that at least one target would be compromised,” she said.

In the first of those cases, the victim dialed the number.

One Quick Assist session, then ransomware

In an engagement involving VYPR, a ransomware variant Talos considers new and still operationally immature, the actor used a voice phishing call to get a user to start a Microsoft Quick Assist session. Talos could not confirm what the caller said. RMM software already on the network then ran PowerShell commands that downloaded and installed a Microsoft Software Installer package from a remote IP address.

The VYPR operators built on older leaked Conti-derived source code with minimal changes. To knock out EDR tools, they loaded trusted but flawed drivers to gain kernel-level access, a technique called bring your own vulnerable driver, and dropped an unusually large number of them, possibly as backups. Data exfiltration ran over multiple days, which Talos does not commonly see in ransomware cases. The group had no data leak site until after the engagement ended.

A script went after Claude Code credentials

On a separate macOS endpoint, infected through a trojanized application, attackers scripted a search of the keychain, the Mac’s built-in password store, for credentials tied to Anthropic’s Claude Code assistant.

“We observed an attacker-controlled account executing the following command to target Anthropic Claude Code credentials, possibly for credential dumping. There was no indication of the actor using these credentials,” Johnson said. The command was /bin/sh -c security find-generic-password -a “[USER_NAME]” -w -s “Claude Code-credentials”. Its -w flag tells macOS to print the stored secret.

In another case, an insider hired under false credentials used privileged access to install GitHub Copilot CLI and Claude Code. Investigators found no evidence of malicious activity or data theft. The employee’s developer access, which included cloning repositories and connecting to databases, could have let them use those tools to automate malicious actions.

Logs, MFA and help desk checks

Talos IR recommends phishing-resistant MFA such as FIDO2/WebAuthn and hardware security keys in place of push and SMS prompts. It also recommends requiring help desk verification before employees can enroll new MFA methods themselves.

Among engagements where the entry point was known, phishing remained the top initial access method at 37 percent, down from over 50 percent last quarter. Exploitation of public-facing applications followed at 33 percent. Credential and secret management problems and weak authentication or MFA each turned up in 33 percent of engagements.

Insufficient logging led the list of weaknesses, appearing in over 40 percent of engagements, partly because attackers deleted logs and partly because customers had not retained or configured them. Talos recommends at least 90 days of centralized log retention, with logs forwarded off each device so they survive tampering and rebuilds.