Fake IT Help Desk Callers Got by on Little More Than Names and Email Addresses
Help Net Security, Friday, October 30th, 2026
Cisco Talos found fake IT help desk callers breached firms using only employee names and email addresses, in one case leading to ransomware.
Cisco Talos Incident Response reports that in Q3 2026 attackers posing as IT help desk staff contacted employees by phone, email and Microsoft Teams and persuaded them to open remote access sessions.
The attackers appeared to know only names and email addresses and targeted any susceptible user rather than senior staff.
One case led to deployment of a new, immature VYPR ransomware variant built on leaked Conti-derived code.
Talos also describes macOS theft of Claude Code credentials and recommends phishing-resistant MFA, help desk verification before MFA enrollment, and central log retention for at least 90 days.