Security1 hOctober 30, 2026, 13:30

Cisco Talos: fake IT help desk callers gained access via Quick Assist

In Q3 2026, attackers posing as IT help desk staff contacted employees via email and Microsoft Teams, knowing only names and addresses, and talked them into opening remote access sessions. One Quick Assist session ended in a VYPR ransomware attack; phishing remained the top initial access vector at 37% of engagements.

Help Net Security

Open source

Cisco Talos: fake IT help desk callers gained access via Quick Assist

Attackers knew only names and email addresses, with no deep victim profiling
One Quick Assist session led to a VYPR ransomware attack
Phishing was 37% of known entry points; public-facing app exploits 33%
Talos recommends FIDO2/WebAuthn and at least 90 days of log retention

#Cisco#Microsoft#Anthropic#Claude

Cisco Talos: attackers abuse legitimate platforms to deliver phishing emails

Security

Cisco Talos finds CLOSEDQUORUM malware where four AI models vote on its next move

Security

Cisco FMC CVE-2026-20079: CVSS 10.0 auth bypass exploited in the wild

Security

Cisco Talos: fake IT help desk callers gained access via Quick Assist

Cisco Talos: attackers abuse legitimate platforms to deliver phishing emails

Cisco Talos finds CLOSEDQUORUM malware where four AI models vote on its next move

Cisco FMC CVE-2026-20079: CVSS 10.0 auth bypass exploited in the wild

Cisco Talos: Two FMC Flaws Exploited by Three Threat Clusters