Scattered Lapsus$ Hunters Take Aim At Zendesk Users

ReliaQuest observed a campaign (possibly by Scattered Lapsus$ Hunters or copycats) using over 40 typosquatted Zendesk domains and fraudulent helpdesk tickets to host fake SSO portals, harvest credentials, and deliver remote access trojans; a related third-party Zendesk breach impacting Discord is cited. The vendor recommends enforcing MFA (hardware keys), IP allowlisting, domain monitoring, DNS filtering, and chat/content controls to mitigate the threat.