Facilitating Phishing and Pig Butchering Activities using Zendesk Infrastructure [Bait & Switch Mode]

This advisory demonstrates how attackers can register Zendesk subdomains to impersonate companies and deliver phishing pages (including investment “pig butchering” scams). Based on XVigil’s capture of 1,912 matching instances, the report shows registration and invitation workflows, explains how tickets and links can land in recipients' primary inboxes without validation, outlines impacts (data theft, financial and legal risk), and recommends blacklisting unknown Zendesk instances, using XVigil detection, and user education.