Fake help desks gain remote access through routine support
Cisco Talos found that, in Q3 2026, fake IT help-desk callers used employee names and email addresses to persuade staff across several engagements to open remote-access sessions; one Microsoft Quick Assist engagement ended in ransomware. Ransomware and pre-ransomware cases accounted for 27% of Talos IR’s engagements that quarter.
The callers mimicked routine support over phone, email or Microsoft Teams, then guided employees into sessions with Quick Assist or other remote-management tools. Talos found no clear evidence of profiling beyond basic identity and contact information, and targets varied rather than centering on executives or technical staff. Because the employee opens legitimate support software, the resulting access can resemble normal administration—and in one case preceded ransomware.
If employees can launch Quick Assist or similar tools, initial access may sit inside an ordinary support workflow rather than look like a new implant. Talos did not quantify how often these sessions led to ransomware.