Skip to content
HACKTECH
Social engineeringReported Published 2 sources

Cisco Talos IR: fake IT help desk contacts talked staff into remote access in Q3 2026

Cisco Talos Incident Response reported on 29 October 2026 that in several third-quarter engagements, attackers posing as IT help desk staff persuaded employees to allow remote access through legitimate remote monitoring and management (RMM) tools; Help Net Security reported the contacts came by phone, email and Microsoft Teams. In an engagement involving the new VYPR ransomware, a vishing call got a user to start a Microsoft Quick Assist session, after which RMM software already on the network installed an MSI package from a remote IP address, although Talos could not confirm what the caller said. Talos said phishing remained the most common initial access vector, appearing in 37% of engagements, while ransomware and pre-ransomware incidents rose to 27%.

  • vishing
  • help desk impersonation
  • Microsoft Teams
  • Quick Assist
  • RMM tools
  • ransomware
  • VYPR
  • incident response trends

What the sources report

  • Ransomware and pre-ransomware incidents made up 27% of Talos IR engagements in Q3 2026, involving groups including The Gentlemen, Qilin, Rhysida and Interlock as well as the emerging VYPR (Talos).
  • Talos said phishing appeared in 37% of its IR engagements, down from over 50% the previous quarter, with exploitation of public-facing applications second at 33%.
  • A Talos researcher told Help Net Security the attackers appeared to know employee names and email addresses, with no clear evidence of deep company- or victim-specific profiling, and that contacted victims varied across and within organisations.
  • In one apparently opportunistic case, a victim called a fake IT support number shown in a generic browser-based scam pop-up and later granted the attacker remote access (Help Net Security).
  • In the VYPR case the actor used tools including MeshAgent, Rclone and PsExec, exfiltrated data over multiple days, and disabled EDR and antivirus with bring-your-own-vulnerable-driver techniques (Talos).
  • Insufficient logging was the most common weakness, in over 40% of engagements; Talos recommended phishing-resistant MFA such as FIDO2/WebAuthn, helpdesk verification for self-service MFA enrolment, and centralised logs retained for at least 90 days.

What it means for your organisation

This is the remote-control variant of help desk impersonation: rather than relaying a password and MFA code, the caller talks a user into launching Quick Assist or accepting a remote session, so sign-in controls alone do not stop it. A Talos researcher said the attackers needed little more than names and email addresses and reached staff across roles, so controls aimed only at administrators and executives would miss many targets. Restricting remote-support tooling and external Teams contact, and keeping enough logs to reconstruct a session, matter as much as user awareness.

What we check

  • Inventory remote support and RMM tools such as Quick Assist and MeshAgent, confirm only approved tools can run, and alert on new RMM installs or sessions.
  • Review Microsoft Teams external access and federation settings and test whether an outside account named 'Help Desk' can chat with or call employees.
  • Run a consented IT-support vishing and Teams impersonation exercise against general staff, not only executives, and measure how often it is reported.
  • Verify logs are centralised and retained for at least 90 days off-device so incident responders can reconstruct remote sessions, PowerShell activity and EDR tampering.
  • Test EDR tamper protection and vulnerable-driver blocklists against bring-your-own-vulnerable-driver techniques.

Sources

Services that cover these checks

  • Social engineering assessment

    Phishing, vishing and physical pretexting run against your staff, help desk and finance team, only under written authorisation that names the targets, pretexts and limits. Results are reported by channel and pretext, never by name: how far a convincing approach got, how many people reported it and how long the first report took to reach someone who acted.

    Duration: 2 to 4 weeks including campaign preparation

  • Incident response

    Hands-on help when an attacker is already inside: triage on the first call, containment that does not destroy evidence, forensic scoping of what was touched, and recovery that we verify before calling it complete. Outside a crisis we run retainers, tabletop exercises and compromise assessments, so your team has practised the first hour before it happens.

    Duration: Live incidents until recovery is verified; readiness work in days

  • Red team & purple team

    Objective-based adversary simulation: we agree the objectives, try to reach them over several weeks and measure what your detection and response do along the way. Purple mode runs the same scenarios with your defenders in the room, tuning detection as each technique is replayed.

    Duration: 3 to 6 weeks

  • Cloud configuration review

    An IAM-first review of AWS, Azure or GCP. We map what an attacker reaches after compromising one workload or one developer laptop, then rank those paths by the data at the end of each and write the Terraform or policy change that cuts it.

    Duration: 4 to 8 working days

Run these checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Scope an engagementHow incident response works