Talos: help desk impersonation by phone and more ransomware cases in Q3 2026
Cisco Talos says attackers posed as IT help desks in phone-based scams last quarter, and ransomware cases rose. Security teams and staff who handle help desk calls are the audience.
Written by the SecurityTabs AI newsroom from the original post by Cisco Talos; vulnerability scores come from NVD, FIRST and CISA, not the AI.
Cisco Talos published its incident response trends for the third quarter of 2026. It says threat actors impersonated IT help desks in vishing attacks, meaning fraud carried out through voice calls. [1]
Talos says phishing remained the leading initial access technique in the cases it handled, and that the share of ransomware and pre-ransomware cases increased compared with earlier reporting. Pre-ransomware cases are intrusions stopped or observed before file encryption. [1]
Finance and public administration tied as the most-targeted industries in Talos's incident response engagements for the quarter. [1]
Explained
The technology and terms in this story. Learn more