Cisco Talos investigated a VYPR ransomware incident in which an attacker used a voice-phishing call to trick a user into starting a Microsoft Quick Assist remote-support session. Talos also observed IT help desk impersonation in several other incidents, showing that a seemingly routine support call can give criminals remote access and lead to ransomware.
In this incident investigated by Cisco Talos, an attacker used a vishing call to impersonate IT help desk staff. The caller told the target they needed remote technical assistance and asked them to open Microsoft Quick Assist to start a remote-support session. Once the session was active, the attacker had direct remote access to the endpoint. This case was linked to a VYPR ransomware deployment, and Talos noted that IT help desk impersonation during vishing calls was observed in several other Q3 engagements, not just this one.
After establishing remote access, the actor used existing remote-management software already present in the environment to execute PowerShell commands. Those commands downloaded and installed a Microsoft Software Installer package from a remote IP address, extending the attacker's foothold beyond the initial Quick Assist session.
The pretext worked because it exploited a routine, expected interaction: an employee receiving IT support. The request to launch a remote-access tool did not look unusual on its face, especially when delivered with confidence by someone claiming to be help desk staff. Talos's broader findings put this in context. Phishing, including vishing, was the most common initial-access method across Talos IR engagements, appearing in 37 percent of cases, and ransomware and pre-ransomware incidents made up 27 percent of engagements, up from a maximum of 20 percent in the prior four quarters.
Underlying weaknesses also played a role in how far these incidents progressed. Talos identified insufficient logging, weak credential management, and missing or poorly implemented MFA as the most common security gaps across the engagements it reviewed.
Organizations can reduce the chance of this pretext succeeding by reinforcing a few habits across all employees, remote workers, and especially IT help desk staff and privileged-account holders:
These incidents show that a single phone call exploiting trust in IT support can be enough to open the door to a full ransomware event, which is why verification habits and credential hygiene matter as much as technical controls.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
The attacker used a vishing call to impersonate IT help desk staff and convinced the user to start a Microsoft Quick Assist remote-support session, which gave the attacker remote access to the endpoint.
The actor used existing remote-management software to run PowerShell commands that downloaded and installed a Microsoft Software Installer package from a remote IP address.
Talos observed this impersonation technique in several Q3 engagements because employees are conditioned to cooperate with IT support requests, making them more likely to start a remote session without independently verifying the caller.
Insufficient logging, weak credential management, and missing or poorly implemented MFA were the most common weaknesses identified across these engagements.
“IT help desk here. Please start Microsoft Quick Assist.” Unexpected call? Pause. That’s vishing: someone impersonates IT to get remote access. In a VYPR ransomware case, one Quick Assist session let the caller onto an employee’s computer. Here’s the catch: a help desk name on your phone isn’t a support ticket. After access, the VYPR operator used remote-management software to run PowerShell and install a package. Before starting Quick Assist for an unexpected caller, call your help desk using the number in your company directory.
Attackers used external Microsoft Teams chats to impersonate internal IT support and convince employees to grant remote access to their Windows computers. In many cases, they first flooded inboxes with subscriptions or confirmation emails, then offered fake assistance and persuaded victims to use…
Attackers are using Microsoft Teams external chat to pose as internal IT support staff, often after overwhelming employees with email subscription messages. They persuade victims to join a voice call, approve remote-control tools, or run commands, with some incidents ending in malware infections…
Researchers reported a months-long campaign where attackers used Microsoft Teams chats/calls while pretending to be IT/help desk support. Victims were talked into starting remote-control sessions (Quick Assist or RemSupp), after which the attackers used PowerShell to maintain access and, in some…
Attackers are calling employees on Microsoft Teams while pretending to be internal IT support, then persuading them to approve a Microsoft Quick Assist remote-control session. Once the employee approves, the attacker can take control of the computer and use PowerShell to install a Go-based backdoor…
Cisco Talos reports a remote access trojan (msaRAT) linked to the Chaos ransomware group that hides its command-and-control traffic inside legitimate Chrome/Edge browser activity. The malware is delivered as a fake “Windows update” MSI and, once run, launches a browser in a special debug mode to…
Attackers overwhelm employees with hundreds of spam messages, then contact them through Microsoft Teams while posing as internal IT support. They offer to fix the inbox problem, move victims into a voice call, and persuade them to install or use remote-access tools such as Quick Assist. The scams…
