Help desk vishing became a prominent route into corporate networks during Q3 2026. Cisco Talos found attackers impersonating IT support staff and persuading employees to authorise legitimate remote monitoring and management access.
The finding forms part of the Cisco Talos Incident Response review published on 29 October 2026. It covers engagements investigated from July to September 2026, including phishing, ransomware, exploitation of internet-facing systems and prolonged espionage operations.
Help desk vishing changes the phishing threat
Phishing remained the most common initial access technique, appearing in slightly more than one third of Talos engagements. That was a notable reduction from more than half of engagements in Q2 2026, but the figures also show how attackers are expanding beyond conventional malicious links and attachments.
Numerous threat actors combined voice phishing, commonly called vishing, with IT help desk impersonation. During these calls, an attacker posed as a trusted support employee and convinced the target to install, launch or approve a legitimate remote monitoring and management tool.
This approach exploits an established business process rather than a technical vulnerability. Once the employee authorises the session, the attacker receives a functional remote connection that may resemble ordinary IT administration and may therefore attract less immediate scrutiny than custom malware.
Legitimate RMM tools provide alternate access
Other campaigns reported during 2026 reinforce the help desk vishing findings. Microsoft reported on 29 September 2026 that phishing campaigns had dropped MSP360 RMM and ScreenConnect onto targeted systems. MSP360 RMM was used to deploy ScreenConnect, giving attackers redundant remote access channels.
These connections can support credential theft, internal discovery and data collection. Using more than one RMM product can also help an intruder retain access if defenders discover and remove one client.
The technique creates an important distinction for security teams. Detecting an RMM executable is not necessarily enough because these are legitimate commercial products. Investigators must establish whether the installation was approved, who initiated it, which account authorised it and whether its network activity matches an expected support session.
Ransomware rises as attackers suppress EDR
Ransomware and pre-ransomware activity represented 27 per cent of Talos engagements in Q3 2026. This was higher than the maximum recorded in any of the previous four quarters.
Talos responded to incidents involving The Gentlemen, Qilin and Rhysida ransomware-as-a-service operations. It also observed Interlock, which operates as a closed group, and the emerging VYPR variant. VYPR’s operators appeared to test different tactics and procedures rather than follow a consistent affiliate playbook.
A recurring feature was the deliberate suppression of endpoint detection and response tools before encryption or other disruptive actions. Attackers frequently pursued two methods:
- Bring your own vulnerable driver attacks, where a legitimately signed but vulnerable driver is introduced and exploited to terminate protected EDR processes.
- Windows Defender Application Control abuse, where a hostile policy prevents security drivers or services from loading after a reboot.
Talos has previously documented a vulnerable Baidu driver used by a loader associated with DeadLock ransomware. The wider technique allows attackers to exploit trusted kernel-level software rather than attempt to defeat an EDR product directly.
Malicious WDAC policies achieve a similar objective through a different route. Because WDAC is a legitimate Windows security feature, an attacker with sufficient privileges can configure it to block the components on which endpoint monitoring depends. The resulting loss of telemetry can give ransomware operators a quieter window in which to move through the environment.
Edge devices account for one third of initial access
Exploitation of public-facing applications accounted for about one third of Q3 2026 engagements. Security gateways, VPN infrastructure and remote network management interfaces were prominent targets because they sit at the boundary of corporate environments and often control authentication or network traffic.
Compromising an edge device can provide access without first infecting an employee workstation. These systems may also have less comprehensive monitoring than conventional endpoints, making unauthorised configuration changes or administrative activity harder to identify.
Salt Typhoon and Cisco IOS XE exploitation
Talos continued to investigate prolonged intrusions affecting telecommunications organisations. It attributed most of this activity with high confidence to China state-sponsored actors, including Salt Typhoon.
The operators combined valid credentials with exploitation of CVE-2023-20198 in publicly accessible Cisco IOS XE web management interfaces. The vulnerability affects physical and virtual IOS XE devices where the Web UI HTTP or HTTPS server is enabled through the ip http server or ip http secure-server configuration commands.
CVE-2023-20198 allows an unauthenticated attacker to create a privilege level 15 local account. Attackers can then chain it with CVE-2023-20273 to execute commands with root privileges and install BadCandy, a Lua-based web shell that provides stealthy remote command execution.
In at least one Q3 campaign, Salt Typhoon-linked operators deployed BadCandy for persistence. They also used legitimate infrastructure capabilities, including VPN access, traffic mirroring and management protocols, to conduct reconnaissance, establish backdoors and remove data.
Observed actions included creating privileged accounts, disabling logging and changing device configurations. These activities blended with normal administration, particularly where organisations used password-only authentication, weak management protocols or poorly controlled privileged credentials.
CVE-2023-20198 exploitation remains active
Cisco first published its active exploitation advisory for CVE-2023-20198 on 16 October 2023. Talos updated its analysis between 19 October and 2 November 2023, naming BadCandy and publishing further detection material. Fixed software began rolling out on 22 October 2023.
The threat did not end with those updates. The Australian Cyber Security Centre warned on 31 October 2025 that BadCandy activity exploiting CVE-2023-20198 remained ongoing. Talos’ latest findings show the vulnerability was still relevant to operational intrusions in Q3 2026, while public proof-of-concept code targeting the web management endpoint remains available.
BadCandy is generally removed when an affected device reboots, but that does not resolve the underlying exposure. An unpatched and internet-accessible interface can be compromised again. Unexpected privilege level 15 accounts, disabled logging and unexplained configuration changes should all be treated as reasons for deeper investigation.
Actions tied to the Q3 2026 findings
Organisations should focus their response on the access routes and defensive bypasses observed in these incidents:
- Identify every approved RMM product and alert on unplanned MSP360 RMM, ScreenConnect or other remote administration installations.
- Require separate verification before employees approve help desk remote access, particularly after an unsolicited telephone call.
- Check IOS XE configurations for enabled HTTP or HTTPS management services, apply Cisco’s fixed software and disable the Web UI where it is not required.
- Restrict management interfaces to trusted networks and enforce multi-factor authentication for remote and privileged access.
- Monitor for vulnerable driver loading, unexpected WDAC policy changes, EDR service failures and security tools that do not restart after a reboot.
The Q3 figures show that help desk vishing, exposed management systems and ransomware defence evasion are connected operational risks. Attackers are increasingly using trusted tools and administrative features, so context, authorisation records and configuration monitoring are essential for distinguishing routine support from an active intrusion.
Originally reported by blog.talosintelligence.com.
