Fake IT help desk callers got by on little more than names and email addresses Attackers posing as IT help desk staff contacted employees by phone, email and Microsoft Teams in the third quarter of 2026 and talked them into opening remote access sessions, Cisco Talos Incident Response (Talos IR) found across several engagements. In one case, that access ended in ransomware. They knew names and email addresses “The attackers appeared to know employee names and email addresses, as they contacted users directly by email and Teams and used identities that mimicked legitimate company help desk personnel,” Aliza Johnson, a researcher at Cisco Talos, told Help Net Security. “They likely had broad, generic knowledge of how IT support interactions typically work as they successfully guided victims…