Extortion Groups Are Impersonating Help Desks to Gain Initial Access
KnowBe4, Tuesday, October 13th, 2026
ReliaQuest reports a surge in vishing and Teams phishing by extortion groups like ShinyHunters posing as IT help desks.
KnowBe4 summarizes ReliaQuest observations of rising voice phishing and Microsoft Teams phishing from extortion groups such as ShinyHunters, whose attackers posed as internal IT support and used vishing, device-code phishing, external Teams impersonation, stolen tokens and attacker-controlled authentication methods.
Once inside, they used legitimate software and over-privileged accounts to collect data and move laterally.
Employees are urged to be wary of unsolicited tech support contacts, even from apparent coworkers.