high
Cisco Talos IR: Fake IT help desk vishing, Quick Assist abuse and new VYPR ransomware in Q3 2026 engagements
1 fonte(s)
·
1 atualização(ões)
·
publicado 30/10/2026 03:30
·
coletado há 1 hora
Cisco Talos Incident Response reports that attackers impersonating IT help desk staff contacted employees by phone, email and Microsoft Teams in Q3 2026 and persuaded them to open remote access sessions. One engagement ended in VYPR ransomware. Attackers appeared to know only employee names and email addresses, and targeted any susceptible user rather than privileged staff.
Detalhes técnicos
- In the VYPR case, a voice phishing call led a user to start a Microsoft Quick Assist session. RMM software already on the network then ran PowerShell commands that downloaded and installed an MSI package from a remote IP address.
- VYPR is considered new and operationally immature by Talos. It is built on leaked Conti-derived source code with minimal changes.
- Operators used bring-your-own-vulnerable-driver (BYOVD), dropping an unusually large number of drivers to disable EDR. Exfiltration ran over multiple days, and no leak site existed until after the engagement.
- Some attacks were opportunistic: a victim called a fake support number from a generic browser scam pop-up, and another actor ran two phishing waves.
- On a macOS endpoint infected through a trojanized application, attackers ran
/bin/sh -c security find-generic-password -a "[USER_NAME]" -w -s "Claude Code-credentials"to target Claude Code credentials. There was no indication the credentials were used. - In a separate case, an insider hired under false credentials installed GitHub Copilot CLI and Claude Code using privileged access. No malicious activity or data theft was found.
- Among engagements with a known entry point, phishing accounted for 37% of initial access (down from over 50% the previous quarter) and exploitation of public-facing applications for 33%. Credential/secret management problems and weak authentication or MFA each appeared in 33% of engagements. Insufficient logging appeared in over 40%.
Remediação
- Use phishing-resistant MFA (FIDO2/WebAuthn, hardware keys) instead of push and SMS.
- Require help desk verification before employees enroll new MFA methods.
- Retain at least 90 days of centralized logs, forwarded off each device.
Linha do tempo
-
Cisco Talos IR: Fake IT help desk vishing, Quick Assist abuse and new VYPR ransomware in Q3 2026 engagements
ler a análise desta fonte ocultar
Cisco Talos Incident Response reports that attackers impersonating IT help desk staff contacted employees by phone, email and Microsoft Teams in Q3 2026 and persuaded them to open remote access sessions. One engagement ended in VYPR ransomware. Attackers appeared to know only employee names and email addresses, and targeted any susceptible user rather than privileged staff.
Technical Details
- In the VYPR case, a voice phishing call led a user to start a Microsoft Quick Assist session. RMM software already on the network then ran PowerShell commands that downloaded and installed an MSI package from a remote IP address.
- VYPR is considered new and operationally immature by Talos. It is built on leaked Conti-derived source code with minimal changes.
- Operators used bring-your-own-vulnerable-driver (BYOVD), dropping an unusually large number of drivers to disable EDR. Exfiltration ran over multiple days, and no leak site existed until after the engagement.
- Some attacks were opportunistic: a victim called a fake support number from a generic browser scam pop-up, and another actor ran two phishing waves.
- On a macOS endpoint infected through a trojanized application, attackers ran
/bin/sh -c security find-generic-password -a "[USER_NAME]" -w -s "Claude Code-credentials"to target Claude Code credentials. There was no indication the credentials were used. - In a separate case, an insider hired under false credentials installed GitHub Copilot CLI and Claude Code using privileged access. No malicious activity or data theft was found.
- Among engagements with a known entry point, phishing accounted for 37% of initial access (down from over 50% the previous quarter) and exploitation of public-facing applications for 33%. Credential/secret management problems and weak authentication or MFA each appeared in 33% of engagements. Insufficient logging appeared in over 40%.
Remediation
- Use phishing-resistant MFA (FIDO2/WebAuthn, hardware keys) instead of push and SMS.
- Require help desk verification before employees enroll new MFA methods.
- Retain at least 90 days of centralized logs, forwarded off each device.