---
title: Talos IR Q3 2026: ransomware rises to 27% of engagements, help-desk vishing into Quick Assist and RMM is a common way in, and attackers start stealing Claude Code keychain secrets | ctxsec
url: https://ctxsec.com/items/talos-ir-trends-q3-2026-vishing-help-desk-ransomware-27pct
description: ""
status: "vendor research (Cisco Talos Incident Response, Oct 29)"
published: 2026-10-29
---

> 

[← Industry News](/industry) · [markdown](/items/talos-ir-trends-q3-2026-vishing-help-desk-ransomware-27pct.md)

vendor research (Cisco Talos Incident Response, Oct 29)

2026-10-29

### Talos IR Q3 2026: ransomware rises to 27% of engagements, help-desk vishing into Quick Assist and RMM is a common way in, and attackers start stealing Claude Code keychain secrets

- **Initial access:** phishing 37% (down from over 50%), often vishing that impersonates IT and gets the user to open Quick Assist or an RMM tool; exploitation of public-facing apps 33%, mostly edge devices and management interfaces.
- **Ransomware:** 27% of engagements, up from at most 20% in the previous four quarters: The Gentlemen, Qilin, Rhysida, Interlock and a new, immature group, **VYPR** (Conti-derived code, no leak site at the time, many vulnerable drivers dropped to kill EDR, multi-day exfiltration with MeshAgent, Rclone, PsExec). Interlock tried to uninstall Cisco Secure Endpoint and has used malicious WDAC policies.
- **Espionage:** Salt Typhoon-linked telecom intrusions via valid credentials and CVE-2023-20198 on exposed IOS XE web UIs, with the BadCandy implant, new privileged accounts and disabled logging.
- **AI:** one insider hired under false credentials installed Copilot CLI and Claude Code with developer access; a trojanized macOS app scraped keychain items for Claude Code.
- **Sectors:** finance and public administration tied at 18%; healthcare fell to third.

**Top weaknesses:** insufficient logging (over 40%), poor secret handling (33%) and missing or weak MFA (33%). Talos recommends at least 90 days of central log retention, phishing-resistant MFA, and help-desk verification before MFA enrollment.

Sources: [Cisco Talos: IR trends Q3 2026, actors impersonate IT help desks in vishing attacks as ransomware activity increases (Oct 29)](https://blog.talosintelligence.com/ir-trends-q3-2026/)