Fake IT help desk calls led to remote access and VYPR ransomware
Cisco Talos says callers often knew only names and emails, and one Quick Assist session ended in ransomware.
68
- Mentions · 7d2
- Mentions · 30d2
- All mentions2
- First seenOct 29, 2026
- Last mentioned14h ago
Timeline
2 articles · newest firstTalos Q3 2026 IR trends: help-desk vishing and rising ransomware
Phishing led initial access in just over one-third of engagements, down from over 50 percent, while ransomware rose to 27 percent.
66
Related CVEs
by mentions- CVE-2023-20198100%10.0Unauthenticated Privilege Escalation in Cisco IOS XE Web UI (Actively Exploited)
Appears with
- GitHub Copilot CLIproduct · 2
- Microsoft Teamsproduct · 1
- Rhysidamalware · 1
- GitHubvendor · 1
- Salt Typhoonthreat actor · 1
- Ciscovendor · 1
- Cisco Talosorganization · 1
- Interlockthreat actor · 1
- Microsoft Quick Assistproduct · 1
- Qilinmalware · 1
- Contimalware · 1
- Anthropicvendor · 1
- Microsoftvendor · 1
- The Gentlemenmalware · 1
- Claude Codeproduct · 1
- BadCandymalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.