As cited
Copy frozen at (site build).
threat intel
Fake IT help desk callers got by on little more than names and email addresses
Attackers impersonated IT help desk staff and contacted employees via phone, email, and Microsoft Teams in the third quarter of 2026, using only names and email addresses to establish credibility. Cisco Talos Incident Response observed these social engineering campaigns across multiple engagements, with at least one leading to ransomware deployment. The attackers' minimal information requirements suggest either public data harvesting or prior reconnaissance.
Why it matters: Employees and security teams must recognize that attackers need only basic contact details to initiate plausible help desk impersonation; implement caller verification protocols and restrict remote access tool distribution to prevent initial compromise.
- Source published
- First seen by Cybersecurity Tracker