Fake IT help desk vishing campaign — multiple orgs: attackers posed as IT support via phone/email/Teams to gain remote access, leading to VYPR ransomware
Severity: high · Patch status: no-fix-needed · Since 2026-10-30
Cisco Talos IR reported several Q3 2026 incidents in which attackers posing as IT help desk staff contacted employees by phone, email and Microsoft Teams using known names and email addresses, and talked them into opening remote access sessions (e.g., Microsoft Quick Assist). In one case this led to VYPR ransomware — a Conti-derived variant that used bring-your-own-vulnerable-driver techniques to disable EDR and exfiltrated data over multiple days. Separately, a trojanized macOS app led to scripted keychain searches for Claude Code credentials, and a fraudulently hired insider installed AI coding tools with privileged access. Phishing was the top initial access method (37%), and insufficient logging appeared in over 40% of engagements. Mitigations: phishing-resistant MFA, help desk verification for MFA enrollment, and 90+ days of centralized off-device log retention.
What to do
- Deploy phishing-resistant MFA (FIDO2/WebAuthn, hardware keys) replacing push/SMS prompts
- Require help desk verification before employees can enroll new MFA methods
- Train staff that IT support will never initiate Quick Assist/remote access sessions unprompted
- Retain centralized logs at least 90 days, forwarded off-device to survive tampering
- Monitor for BYOVD driver loading and unexpected RMM/Quick Assist sessions
- Audit insider and contractor identity vetting and privileged developer access
Sources
All live incidents on Threat Watch
