Cisco Talos found phishing in 37% of its third-quarter incident response cases, and it was still the most common way attackers got in, even as its share fell. Talos also saw attackers phone staff posing as the IT help desk in several cases. In one case, a user was tricked into opening a remote access session, and the attackers went on to deploy ransomware. For healthcare IT teams, social engineering now needs a defense on the phone line as well as in the inbox.

Phishing still led initial access in Q3, and ransomware's share rose

Talos published its Q3 2026 incident response trends on October 29. Phishing's share fell from over 50% the quarter before, but it remained the most common way attackers got in. Exploitation of public-facing applications, such as security gateways and remote management interfaces, came next at 33%.

Ransomware and pre-ransomware incidents made up 27% of engagements, up from a maximum of 20% across the previous four quarters, according to Talos.

These figures are shares of one incident response team's caseload, so a lower phishing share partly reflects other entry points taking up more of the work. Health care was the third most targeted sector in Q3, after ranking first for the two quarters before.

Talos saw attackers pose as the IT help desk by phone to get remote access

Talos reported that "numerous threat actors" used voice phishing (vishing) along with IT help desk impersonation "to socially engineer the victim into allowing remote access via a legitimate remote monitoring and management (RMM) tool."

In one case, a new ransomware group Talos calls VYPR "tricked a user into initiating a Microsoft Quick Assist session, allowing remote access to the endpoint." Talos couldn't confirm the exact social engineering technique in that case, but it says attackers "frequently impersonate IT help desks during vishing calls," a tactic it saw in several other Q3 engagements.

From that session, the attackers used existing remote management software to install more tools, took data out over several days, and loaded vulnerable drivers to switch off endpoint detection before deploying ransomware.

The same pitch also arrives by chat. Paubox has covered how attackers pose as IT support in Microsoft Teams to get staff to install remote access tools, and how Health-ISAC tied a Q3 rise in healthcare incidents to help desk impersonation campaigns.

An email filter can't stop the help desk call

A phone call never passes through an email filter. Email often sets up the call, though. In the Teams campaigns Paubox covered, attackers first flood a staff member's inbox with spam, then contact them posing as IT support to "fix" it. Filtering that flood and the phishing that still leads initial access is part of HIPAA compliant email. The call itself needs a verification process.

The help desk call works best where MFA is weak or missing

Talos found missing or insufficient authentication and multi-factor authentication (MFA) in 33% of its Q3 engagements. The most common problem was reliance on single-factor authentication. Talos also found legacy authentication protocols still enabled, which let attackers log in without MFA, and some environments that didn't enforce MFA on high-privilege accounts.

Push prompts and SMS codes help less against this attack, because a caller can talk a staff member into approving a prompt or reading out a code. Phishing-resistant methods, such as hardware security keys, don't produce a code a caller can ask for.

Healthcare organizations may soon have to close this gap anyway. The proposed HIPAA Security Rule update would require regulated entities to use MFA, with limited exceptions.

Verification and phishing-resistant MFA address the help desk call

The first two steps come from Paubox's Teams coverage and the last three from Talos. Most are process and configuration changes a practice can start now:

  • Verify every remote access request through a known channel. If someone asks a staff member to open Quick Assist or install another remote access tool, the staff member calls the help desk back at a number they already have. The Teams post above walks through the warning signs.
  • Limit remote access tools to the ones IT has approved, and monitor for unusual account activity.
  • Move to phishing-resistant MFA. Talos recommends replacing push and SMS-based MFA with phishing-resistant methods such as FIDO2/WebAuthn and hardware security keys. Paubox's MFA FAQ covers the basics.
  • Require help desk verification for MFA enrollment, as Talos recommends, so an attacker can't add their own device to a staff member's account.
  • Keep logs off the device for at least 90 days. Talos found insufficient logging in over 40% of its Q3 engagements. It recommends a central log platform with a minimum of 90 days of retention, because attackers often delete local logs.

Phishing's smaller share of Talos's caseload doesn't mean the fake help desk call stopped coming. Talos saw that pitch in several Q3 engagements, and in one case a vishing call led to a ransomware deployment.