Fake IT help desk calls led to remote access and VYPR ransomware
Original title: Fake IT help desk callers got by on little more than names and email addresses
Cisco Talos says callers often knew only names and emails, and one Quick Assist session ended in ransomware.
Cisco Talos Incident Response says that in Q3 2026 attackers posed as IT help desk staff by phone, email and Microsoft Teams and persuaded employees to open remote-access sessions. In one case a voice call led a user to start Microsoft Quick Assist; existing RMM software then ran PowerShell that installed a package, and the immature VYPR ransomware followed, with multi-day data theft. On a separate macOS host, a trojanized app was used to query the keychain for Claude Code credentials, with no sign those secrets were used.
Unconfirmed: Talos could not confirm the caller’s script, use of Claude Code credentials, or malicious activity by the insider.
- Targets ranged beyond executives and admins; Talos calls much of it opportunistic.
- VYPR builds on leaked Conti-derived code and used many vulnerable drivers against EDR.
- The group had no leak site until after the engagement ended.
- A separate insider hired under false credentials installed Copilot CLI and Claude Code.
- Where entry was known, phishing was 37% and public-app exploitation 33%.
Impact: Remote access, ransomware, and attempted theft of assistant credentials
- 1.Use phishing-resistant MFA such as FIDO2/WebAuthn or hardware keys.
- 2.Require help desk verification before users enroll new MFA methods.
- 3.Keep at least 90 days of centralized logs forwarded off each device.
- ATT&CK
- T1566.004 Spearphishing VoiceT1219 Remote Access SoftwareT1059.001 PowerShellT1068 Exploitation for Privilege EscalationT1555.001 Keychain
- Organizations
- Cisco Talos
- AI models
- Claude Code
From the original article
3 min read at helpnetsecurity.com
Attackers posing as IT help desk staff contacted employees by phone, email and Microsoft Teams in the third quarter of 2026 and talked them into opening remote access sessions, Cisco Talos Incident Response (Talos IR) found across several engagements. In one case, that access ended in ransomware.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.