Identity · 4h ago
Cisco Talos found that, in Q3 2026, fake IT help-desk callers used employee names and email addresses to persuade staff across several engagements to open remote-access sessions; one Microsoft Quick Assist engagement ended in ransomware. Ransomware and pre-ransomware cases accounted for 27% of Talos IR’s engagements that quarter.
The callers mimicked routine support over phone, email or Microsoft Teams, then guided employees into sessions with Quick Assist or other remote-management tools. Talos found no clear evidence of profiling beyond basic identity and contact information, and targets varied rather than centering on executives or technical staff. Because the employee opens legitimate support software, the resulting access can resemble normal administration—and in one case preceded ransomware.
If employees can launch Quick Assist or similar tools, initial access may sit inside an ordinary support workflow rather than look like a new implant. Talos did not quantify how often these sessions led to ransomware.
2 sources covering this story
Fake IT help desk callers got by on little more than names and email addresses - Help Net Security
Cisco Talos found IT help desk vishing gave attackers remote access as ransomware rose to 27% of its Q3 2026 incident response cases.
Phishing remained the leading initial access technique, while percentage of ransomware and pre-ransomware cases increased.
Part of the PlainSec briefing for 2026-10-30