A Name, an Email Address and a Convincing Voice: How Fake IT Help Desk Callers Talked Their Way Into Remote Sessions, and One Into Ransomware
Cisco Talos incident responders say attackers posing as IT support reached employees through phone calls, email and Microsoft Teams last quarter, talked them into remote sessions and, in one case, deployed ransomware. Here is how the playbook works and the layers that break it.
Here Is How Layered Defenses Help When the Caller Says They Are From IT
The caller does not need to know much. According to Cisco Talos, attackers posing as IT help desk staff in its incident response cases during the third quarter of 2026 appeared to know little more than employees’ names and email addresses, with no clear sign of deeper research into the companies or people involved. That was enough to reach people by phone, email and Microsoft Teams and talk them into opening a remote session.
This briefing is based on Help Net Security’s report on the Cisco Talos quarterly findings.
The playbook in four moves
- Pick a target. Talos found the victims varied widely. Aliza Johnson of Talos said the attackers seemed to go after any user who might fall for it, rather than profiling specific people in depth.
- Sound like IT. The callers imitated help desk identities and leaned on general knowledge, such as familiarity with Microsoft’s Quick Assist remote help tool, rather than inside information.
- Get a remote session. The goal was to have the employee open a screen sharing or remote control session. In some cases the attackers simply took what came along: one victim called a fake support number shown in a generic browser scam pop-up, and another attacker sent two separate waves of phishing emails.
- Use the foothold. In one engagement, after a Quick Assist session, the attackers used remote management software already present on the network to run PowerShell, which downloaded and installed a package from a remote address. Talos could not confirm what the caller said. The case ended with VYPR, a new and still immature ransomware strain that Talos says is built on older leaked code derived from the Conti ransomware family. The attackers used vulnerable drivers to switch off security tools and pulled data out over several days.
The numbers behind the quarter
- Among cases where the entry point was known, phishing remained the top way in, at 37%, down from more than half the previous quarter.
- Exploiting public-facing applications came close behind at 33%.
- Poor handling of credentials and secrets, and weak sign-in or multifactor protection, each showed up in 33% of engagements.
- Insufficient logging hampered investigations in more than 40% of cases.
Talos also described an insider case, involving a person hired under false credentials who installed AI coding tools on a work system, though responders found no malicious activity in that instance.
The layers that break the playbook
No single control stops a convincing caller, but each layer below removes one of the steps the attackers depend on:
- A verification rule for IT contact: make it policy that the help desk never asks staff to start a remote session from an unexpected call, chat or email, and teach staff to hang up and call IT back on a known number.
- Tighter external chat settings: collaboration tools such as Microsoft Teams can limit or flag messages from outside organizations, which makes a fake help desk account easier to spot.
- Control over remote help tools: remove or restrict built-in remote assistance tools on computers that do not need them, and keep a short list of approved remote management software so anything else stands out.
- Phishing-resistant multifactor sign-in: Talos recommends methods based on FIDO2 or WebAuthn, such as security keys or passkeys, instead of push approvals or text codes, and requiring help desk verification before an employee can enroll a new sign-in method.
- Endpoint protection that resists tampering: since this group disabled security tools with vulnerable drivers, use protection with tamper safeguards and block known vulnerable drivers where your platform allows it.
- Logs kept somewhere safe: Talos recommends at least 90 days of centrally stored logs, sent off the device so attackers cannot erase them.
What this means for your company
The most important defense here costs nothing: a clear, well-known rule about how your IT support will and will not contact people, repeated often enough that staff feel comfortable hanging up on a caller who breaks it. Back that rule with technical layers, so that a single mistake in a single phone call does not give an attacker everything. Phishing-resistant sign-in, limits on remote help tools and centralized logging are achievable for businesses of almost any size.
Want to test how your team would handle a call from a fake help desk, and which layers would catch it if they did not? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
