IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases

Cisco Talos's Q3 2026 incident response review finds phishing still the top initial access vector, with threat actors increasingly pairing voice phishing with IT help desk impersonation to get victims to grant remote access through legitimate RMM tools.