Fake IT help desk callers got by on little more than names and email addresses

### Executive summary Cisco Talos Incident Response observed opportunistic social-engineering campaigns in Q3 2026 where attackers impersonated IT support to coerce employees into remote-access sessions, leading in at least one engagement to deployment of VYPR ransomware (which used vulnerable drivers to bypass EDR and performed multi-day data exfiltration). Additional compromises included macOS keychain searches targeting Anthropic Claude Code credentials and an insider using false credentials to install developer automation tools; Talos emphasizes stronger phishing-resistant MFA, help-desk verification controls, and centralized log retention.