IT Help Desk Impersonation: How Vishing Attacks Are Leading to Ransomware

Cisco Talos Incident Response has shared findings from multiple engagements during the third quarter of 2026 in which attackers successfully impersonated IT help desk staff to obtain remote access to employee devices. As reported by Help Net Security, the attackers used real employee names and email addresses to make their approach appear credible, contacting targets by phone, email, and Microsoft Teams. In at least one case, the remote access session that employees were persuaded to open resulted in a ransomware deployment. The attackers required very little information to be convincing, and the use of Teams as a contact channel appears to have increased the likelihood that employees would comply without following standard verification steps.

Why this matters for UK organisations

IT help desk impersonation is a well-established social engineering technique, but the Talos findings are a useful reminder of how effective it continues to be in practice. The use of Microsoft Teams alongside traditional phone and email contact is particularly relevant for UK organisations, where Teams has become the default internal communications platform for many businesses. Employees are accustomed to receiving IT support through Teams, which means they may be less likely to question a message that arrives through that channel. The low information requirement for this attack is also notable: names and email addresses are often available through LinkedIn, company websites, or previous data exposures, meaning the barrier to launching a convincing impersonation campaign is low. The ransomware outcome in one of the Talos engagements underlines that the consequences of a single successful interaction can be severe.

What to review

Organisations should review the verification procedures their IT help desk follows before initiating remote access sessions, and the procedures employees are expected to follow before accepting remote access from anyone claiming to be from IT support. Particular attention should be given to whether Teams is treated as an automatically trusted channel and whether staff understand that it can be used by attackers as convincingly as any other medium. Updating security awareness training to include realistic examples of Teams-based impersonation would be a practical step. Running a simulated vishing exercise, either internally or through a specialist provider, can help identify where awareness and process gaps actually sit before an attacker finds them first. Clear escalation paths for employees who are unsure whether a request is legitimate are also worth establishing or reinforcing.

Source: Help Net Security