Fake IT help desk callers got by on little more than names and email addresses

Attackers posing as IT help desk staff contacted employees by phone, email and Microsoft Teams in the third quarter of 2026 and talked them into opening remote access sessions, Cisco Talos Incident Response found, Help Net Security reports. The attackers appeared to know employee names and email addresses, and in one case the access ended in ransomware.