Scattered Lapsus$ Hunters Registered 40+ Domains Mimicking Zendesk Environments

A threat collective named “Scattered Lapsus$ Hunters” is running a coordinated campaign against Zendesk by registering 40+ typosquatted domains (e.g., znedesk.com, vpn-zendesk.com) that host fake SSO portals to capture credentials and by submitting fraudulent support tickets that trick agents into executing payloads (RATs), enabling persistent access, lateral movement, and theft of sensitive customer data; infrastructure uses NiceNic registrations and Cloudflare-masked nameservers and mirrors prior attacks on Salesforce and Discord.