Skip to content
HACKTECH

Cyber news digest

What broke, and what we check because of it.

Breaches, exploited vulnerabilities, supply chain compromises and new rules, written up for the people who buy security work, with what each one means for an organisation that runs the same kind of systems. Every item cites at least two sources and was verified against them before publication.

52 items214 cited sourcesLatest item 5 November 2026

Showing 2 items in Social engineering. Show all 52 items

October 2026

1 item

  • Social engineering

    Cisco Talos IR: fake IT help desk contacts talked staff into remote access in Q3 2026

    Cisco Talos Incident Response reported on 29 October 2026 that in several third-quarter engagements, attackers posing as IT help desk staff persuaded employees to allow remote access through legitimate remote monitoring and management (RMM) tools; Help Net Security reported the contacts came by phone, email and Microsoft Teams. In an engagement involving the new VYPR ransomware, a vishing call got a user to start a Microsoft Quick Assist session, after which RMM software already on the network installed an MSI package from a remote IP address, although Talos could not confirm what the caller said. Talos said phishing remained the most common initial access vector, appearing in 37% of engagements, while ransomware and pre-ransomware incidents rose to 27%.

    • Social engineering assessment
    • Incident response
    • Red team & purple team

August 2026

1 item

  • Social engineering

    Helpdesk vishing group UNC6671 turns to financial and legal firms, Google reports

    Google Threat Intelligence Group (GTIG) reported on 6 August 2026 that UNC6671, a data theft extortion actor that previously operated under the BlackFile brand, had diversified across extortion brands including Redact, Pink, Helix and Falcon, while noting that splintered affiliates or shared phishing infrastructure could also explain the overlaps. Its callers pose as IT helpdesk staff, often ringing employees' personal mobile phones with an urgent passkey or MFA enrolment pretext, and send them to lookalike portals where adversary-in-the-middle infrastructure intercepts credentials and MFA tokens. GTIG said that by July 2026 targeting had narrowed to the financial and legal sectors, including private equity firms, law firms and financial rating agencies. BleepingComputer reported that the attribution followed Reuters and Bloomberg reports of vishing attacks on several hedge funds.

    • Social engineering assessment
    • Cloud configuration review
    • Incident response

Run the checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Book the scoping callHow incident response works