In the third quarter of 2026, a series of attacks involved individuals posing as IT support staff, contacting employees via phone, email, and Microsoft Teams, according to findings by Cisco Talos Incident Response (Talos IR). These attackers successfully convinced employees to initiate remote access sessions, with one instance resulting in a ransomware attack.
Researchers discovered that the attackers had obtained employee names and email addresses, allowing them to directly contact users and impersonate legitimate company IT personnel. Aliza Johnson, a researcher at Cisco Talos, noted that the attackers seemed to possess general knowledge of typical IT support interactions, which enabled them to guide victims into remote access sessions and demonstrate familiarity with common enterprise tools like Quick Assist.
Attack methodology
The attackers’ tactics involved guiding victims into Microsoft Teams sessions and remote access, showcasing their understanding of common enterprise platforms. However, there was no clear evidence of in-depth company- or victim-specific profiling beyond basic identity and contact information.
The targets of these attacks were diverse, spanning various organizations and roles, suggesting that the attackers were seeking to exploit any vulnerable user for initial access rather than targeting specific individuals for privileged access.
Some attacks appeared to be opportunistic, with one instance involving a victim who called a fake IT support number displayed in a scam pop-up, subsequently granting the attacker remote access.
Ransomware and credential theft incidents
In one notable case, an attacker launched two phishing waves, likely anticipating that at least one target would be compromised. This led to an engagement involving VYPR, a relatively new ransomware variant considered operationally immature by Talos. The attacker used a voice phishing call to convince a user to initiate a Microsoft Quick Assist session, which ultimately resulted in the installation of ransomware.
Although the exact words used by the caller could not be confirmed, the attack involved the execution of PowerShell commands, which downloaded and installed a Microsoft Software Installer package from a remote IP address. The VYPR operators built upon older, leaked Conti-derived source code with minimal modifications.
To evade detection, the attackers employed a technique known as “bring your own vulnerable driver,” loading trusted but flawed drivers to gain kernel-level access. They also deployed an unusually large number of these drivers, possibly as backups. Data exfiltration occurred over multiple days, which is uncommon in ransomware cases. The attackers lacked a data leak site until after the engagement had concluded.
In a separate incident, attackers targeted a macOS endpoint infected through a trojanized application, scripting a search of the keychain, the Mac’s built-in password store, for credentials tied to Anthropic’s Claude Code assistant. Johnson stated, “We observed an attacker-controlled account executing the following command to target Anthropic Claude Code credentials, possibly for credential dumping.
There was no indication of the actor using these credentials.” The command used was /bin/sh -c security find-generic-password -a “[USER_NAME]” -w -s “Claude Code-credentials”, with the -w flag instructing macOS to display the stored secret.
Insider threats and security recommendations
Talos IR recommends implementing phishing-resistant multi-factor authentication (MFA) methods, such as FIDO2/WebAuthn and hardware security keys, to replace push and SMS prompts. Additionally, they suggest requiring help desk verification before employees can enroll new MFA methods themselves.
Among engagements where the entry point was known, phishing remained the top initial access method, accounting for 37 percent of cases, down from over 50 percent in the previous quarter. Exploitation of public-facing applications followed at 33 percent, while credential and secret management problems and weak authentication or MFA each appeared in 33 percent of engagements.
Insufficient logging was the most common weakness, present in over 40 percent of engagements, often due to attackers deleting logs or customers failing to retain or configure them properly. Talos recommends maintaining at least 90 days of centralized log retention, with logs forwarded off each device to ensure they survive tampering and system rebuilds.
Leave a Reply