Talos: fake IT help-desk vishing rose alongside ransomware in Q3
First merged summary.
Cisco Talos says Q3 2026 phishing led known initial access in 37% of cases, while ransomware rose to 27%.
Cisco Talos Incident Response says phishing remained the top initial-access method in Q3 2026, at 37% of cases where entry was known, down from over half the prior quarter. Attackers posed as IT help desks by phone, email and Microsoft Teams, often knowing only names and emails, and persuaded staff to approve legitimate remote tools. In one case a Quick Assist session led to PowerShell, a package install and immature VYPR ransomware with multi-day theft. Public-facing application exploitation was about 33%. Ransomware activity rose to 27%, and Salt Typhoon-linked telecom intrusions exploited CVE-2023-20198 and deployed BadCandy.
- Phishing was 37% of known-entry cases; public-app exploitation about 33%.
- Named strains included The Gentlemen, Qilin, Rhysida, Interlock and immature VYPR.
- VYPR builds on leaked Conti code, used vulnerable drivers against EDR, and had no leak site.
- An insider hired under false credentials installed GitHub Copilot CLI and Claude Code.
- A trojanized macOS app scraped Claude Code keychain credentials; Talos saw no later use.
- Telecom victims lacked MFA and used plaintext SNMP and outdated VPN encryption.
What each outlet adds
beyond the shared facts- Cisco TalosNames ransomware strains, Salt Typhoon, CVE-2023-20198 and telecom control gaps.
- Help Net SecurityDetails Quick Assist-to-VYPR chain, Conti lineage and unused Claude secrets.
- CVEs
- CVE-2023-20198
- Threat actors
- Salt TyphoonInterlock
- Organizations
- Cisco Talos
- Countries
- China
- AI models
- Claude Code
Coverage
oldest first · one row per article · UTC- · 1d ago
Cisco TalosFirst report
Talos Q3 2026 IR trends: help-desk vishing and rising ransomware
Phishing led initial access in just over one-third of engagements, down from over 50 percent, while ransomware rose to 27 percent.
- · 14h ago
Help Net Security
Fake IT help desk calls led to remote access and VYPR ransomware
Cisco Talos says callers often knew only names and emails, and one Quick Assist session ended in ransomware.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-20198 | Unauthenticated Privilege Escalation in Cisco IOS XE Web UI (Actively Exploited) | 10.0 | 100% | KEV | KEV |