[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXrutjaQFhK6gkeOIDOBec7LBH-8cQj9EAGOMiHFhazo":3},{"article":4,"iocs":52,"watch_terms":78,"solutions":79,"lesson":162},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"5c05351c-633f-4c9e-a43f-674c12d46a14","Fake IT help desk callers got by on little more than names and email addresses","fake-it-help-desk-callers-got-by-on-little-more-than-names-and-email-addresses-229275","Attackers posing as IT help desk staff contacted employees by phone, email and Microsoft Teams in the third quarter of 2026 and talked them into opening remote access sessions, Cisco Talos Incident Response (Talos IR) found across several engagements. In one case, that access ended in ransomware. They knew names and email addresses “The attackers appeared to know employee names and email addresses, as they contacted users directly by email and Teams and used identities … More → The post Fake IT help desk callers got by on little more than names and email addresses appeared first on Help Net Security.","Attackers are impersonating IT help desk staff using phone, email, and Microsoft Teams to trick employees into granting remote access. Cisco Talos Incident Response observed this tactic in Q3 2026, noting that in one instance, this access led to a ransomware deployment. The attackers leverage basic employee information like names and email addresses, and exploit common enterprise tools like Microsoft Quick Assist, targeting a wide range of users opportunistically.","Attackers impersonate IT help desk staff to gain remote access, leading to ransomware in some cases.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F10\u002F30\u002Fcisco-talos-it-help-desk-vishing\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F07\u002F15110755\u002Fvoice-1500.webp","2026-10-30T06:30:26+00:00","2026-10-30T07:00:07.43919+00:00",8,[17,20,23,25,27],{"name":18,"type":19},"Cisco","vendor",{"name":21,"type":22},"Talos Incident Response","product",{"name":24,"type":22},"Microsoft Teams",{"name":26,"type":22},"Microsoft Quick Assist",{"name":28,"type":22},"Claude Code","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":29,"icon":31,"name":32,"slug":33},null,"Threat Intelligence","threat-intelligence",[35,40,45,50],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":41},{"id":42,"icon":31,"name":43,"slug":44},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":46},{"id":47,"icon":31,"name":48,"slug":49},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":51},{"id":29,"icon":31,"name":32,"slug":33},[53,56,60,63,66,69,72,75],{"type":44,"value":54,"context":55},"VYPR","Ransomware variant used in an attack",{"type":57,"value":58,"context":59},"mitre_attack","T1204.001","Voice phishing to entice user to initiate a remote session",{"type":57,"value":61,"context":62},"T1219","Remote Access Software",{"type":57,"value":64,"context":65},"T1059.001","PowerShell commands used to download and install malware",{"type":57,"value":67,"context":68},"T1071.001","Application Layer Protocol: Web Protocols for downloading malware",{"type":57,"value":70,"context":71},"T1027","Obfuscated Files or Information: Using trusted but flawed drivers to gain kernel-level access",{"type":57,"value":73,"context":74},"T1041","Exfiltration Over C2 Channel: Data exfiltration over multiple days",{"type":57,"value":76,"context":77},"T1555.003","Credentials from Password Stores: Targeting Anthropic Claude Code credentials from macOS keychain",[18,21,24],{"controls":80,"vendors":158},[81,109,135],{"slug":82,"name":83,"problem":84,"products":85},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[86,94,101],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":95,"vendor_name":18,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":110,"name":111,"problem":112,"products":113},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[114,119,127],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":115,"product_name":116,"url":117,"description":118},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":136,"name":137,"problem":138,"products":139},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[140,147,152],{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":141,"product_name":144,"url":145,"description":146},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":148,"product_name":149,"url":150,"description":151},"managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":153,"vendor_name":154,"vendor_logo":155,"product_slug":153,"product_name":154,"url":156,"description":157},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[159],{"slug":95,"name":18,"logo_path":96,"roles":160},[161],"reported_by",{"slug":163,"title":164,"body":165,"framework_refs":166,"framework_notes":174},"fake-it-help-desk-calls-exploit-employee-trust-to-deploy-ransomware","Fake IT Help Desk Calls Exploit Employee Trust to Deploy Ransomware","Attackers successfully impersonated IT help desk staff using only basic information — employee names and email addresses — to convince users to grant remote access via tools like Microsoft Quick Assist. This incident highlights that human trust, not technical vulnerabilities, was the primary attack surface exploited. The ease with which attackers bypassed defenses demonstrates a critical gap in employee training around verifying the identity of anyone requesting remote access. The consequences were severe, with at least one case escalating to full ransomware deployment, underscoring that social engineering is a direct pathway to catastrophic business disruption.",[167,168,169,170,171,172,173],"CIS Control 14: Security Awareness and Skills Training","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","MITRE ATT&CK T1566: Phishing","CIS Control 17: Incident Response Management","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","NIST SP 800-53 SI-2: Flaw Remediation","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":175,"MITRE ATT&CK T1566: Phishing":176,"NIST SP 800-53 SI-2: Flaw Remediation":177,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":178,"CIS Control 17: Incident Response Management":179,"CIS Control 14: Security Awareness and Skills Training":180,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":181},"NIS2 requires incident handling measures including prevention; the lack of controls to verify IT support identity before granting remote access represents a failure to implement adequate organizational security measures as mandated.","The attack used phone and Teams-based social engineering (vishing\u002Fspear-phishing) to manipulate employees, a technique catalogued under this ATT&CK tactic covering human-targeted deception for initial access.","While the flaw here is procedural rather than technical, this control's principle of addressing identified weaknesses applies — organizations must remediate the human-process vulnerability of unverified remote access approvals.","This clause requires organizations to ensure personnel are competent to recognize security threats; employees lacking training to identify IT impersonation attacks represent a direct gap against this requirement.","The attack escalated to ransomware deployment, suggesting a delayed or absent detection and containment response; a mature IR plan with defined playbooks for social engineering incidents could have limited the blast radius.","Employees were deceived by basic social engineering; a structured awareness program teaching staff to verify IT identities before granting remote access would directly address this attack vector.","Attackers bypassed identity verification entirely — enforcing out-of-band identity confirmation before any remote access is granted aligns with this control's requirement to authenticate and authorize all access requests."]