Cisco Talos Incident Response's Q3 2026 trends report describes attackers calling employees as fake IT help desk staff and talking them into granting remote access, while ransomware and pre-ransomware rose to 27 percent of engagements. Missing or weak authentication showed up in 33 percent of engagements, which makes MFA enrollment and help desk process the identity controls to review.
What happened
Talos published the report on October 29, 2026. It gives percentages only, with no total engagement count, so treat the figures as direction rather than a precise market measure.
| Measure | Q3 2026 share of engagements |
|---|---|
| Phishing as initial access (including vishing) | 37%, down from over 50% last quarter |
| Exploitation of public-facing applications | 33%, mainly edge devices |
| Ransomware and pre-ransomware | 27% |
| Insufficient logging | Over 40% |
| Improper credential and secret management | 33% |
| Missing or insufficient authentication and MFA | 33% |
Talos gives two baselines for the ransomware rise: a maximum of 20 percent across the previous four quarters, and a little over 20 percent last quarter. It names The Gentlemen, Qilin, Rhysida, Interlock and newcomer VYPR.
VYPR is the clearest help desk example. Vishing opened the intrusion, with the user launching a Microsoft Quick Assist session; the social engineering technique itself remains unconfirmed, Talos notes. An MSI package from a remote IP came next, installed via PowerShell launched by the existing remote monitoring and management (RMM) software. Talos also observed MeshAgent, Rclone and PsExec.
Help Net Security, reporting on the Talos research, adds that contact came by phone, email and Microsoft Teams. It says the attackers appeared to know little beyond employee names and email addresses, and seemed to want any susceptible user rather than specific privileged people.
Why it matters
If names and email addresses are enough to start these calls, the barrier to entry is low. Microsoft's recent write-up of Teams help desk lures leading to AD CS abuse shows how far the same opening can go once an attacker is inside.
This data supports the funding case for phishing-resistant MFA, but it doesn't remove the need for other controls. FIDO2 keys resist credential phishing. In our view, they do far less when a user willingly opens a remote session on a desktop that is already signed in. That path also depends on remote support tooling and on users knowing how real IT contacts them.
Talos's enrollment recommendation deserves attention because it moves the help desk into the identity trust chain: self-service MFA enrollment should require help desk verification. That control only holds if the help desk can reliably verify who is asking.
The report also extends the same concern to AI tooling. In one case, a trojanized macOS application led to a script that scraped keychain credentials tied to Claude Code. Help Net Security reports Talos saw no sign the credentials were used. A second case involved someone who got hired using fake credentials, then relied on privileged access to add AI development tools such as GitHub Copilot CLI and Claude Code. Talos says its investigation turned up no evidence of malicious activity or data theft.
What to check in your environment
- Review MFA enrollment. Find out who can register a new MFA method without verification, and require help desk verification as Talos recommends. Document how the help desk confirms a caller's identity.
- Inventory push and SMS MFA. Plan a move to FIDO2/WebAuthn or hardware keys. Where that isn't feasible yet, Talos recommends number matching or verified push.
- Audit high-privilege accounts. Talos found some environments failed to enforce MFA on them. List every privileged account that can still sign in without it.
- Check Conditional Access. Confirm legacy authentication is blocked, review any exceptions, and base access on device compliance and trusted infrastructure, not geography alone.
- Inventory remote support tools. This is our suggestion, not Talos's. List approved RMM products, decide who actually needs Quick Assist, and look for RMM agents such as MeshAgent that nobody approved.
- Test logging against the VYPR pattern. Talos advises 90 days or more in a central platform, with off-device forwarding and process-creation, command-line and cloud API auditing. Confirm you could see RMM software launching PowerShell to install an MSI from a remote IP.
- Tell staff how real IT makes contact. Cover phone, email and Teams, and give users a known internal channel to verify unsolicited support requests.
- Add AI and developer tools to access reviews. Talos calls for strong MFA and credential management on these platforms. Identify where developer endpoints store AI tool credentials and who holds privileged access on those machines.